Bleeping Computer reports that a new malware campaign is actively using SEO-optimized GitHub repositories to impersonate well-known software companies and distribute a previously undocumented information stealer named Rapuncel.The campaign, uncovered by LastPass and Delphos Labs, impersonates LastPass and at least 39 other companies. Attackers lure victims searching for popular software to fake GitHub repositories. Clicking download links leads to redirected payload-delivery servers where victims receive large ZIP archives designed to evade security scans. Inside these archives is a disguised installer that deploys the Rapuncel infostealer and a malicious kernel driver, Alinubx.sys. This driver, masquerading as an NVIDIA component, is capable of disabling 145 antivirus and endpoint detection and response products by terminating their processes, even bypassing protections like Protected Process Light. The driver is signed with a Microsoft publisher chain, making it harder to detect.Once security software is disabled, Rapuncel steals credentials from numerous browsers and cryptocurrency wallets, session data from Discord, Steam, and Telegram, Windows Credential Manager contents, specific document types, screenshots, and system information. It then uploads the compressed data to a remote server. Researchers believe Rapuncel may be a variant of BoryptGrab.Source: Bleeping Computer
