Fake LastPass Authenticator Downloads Deliver Rapuncel Malware That Disables Antivirus

LastPass said it discovered the scheme, in which users searching for “LastPass Authenticator download” or similar terms are shown a GitHub page high in search results. The page closely resembles the genuine LastPass offering, but redirects visitors to a separate site hosted on attacker-controlled infrastructure. That site delivers a large ZIP file containing multiple files.

Two files in the archive are central to the attack: vsdbg.exe and vsdbg.dll. The executable is renamed to look like a LastPass installer, but it is a legitimate Microsoft debugging tool. It is used to run the malicious DLL through DLL sideloading, in which a legitimate program loads a DLL from its own folder rather than the wider system library. Because the malicious DLL is delivered alongside the executable, it runs first.

LastPass shared the malware with security researchers at Delphos, who named it Rapuncel. According to the report, no antivirus engines detected it when it was first analyzed. Once running, Rapuncel gains admin-level access to run as SYSTEM and installs a kernel driver disguised as an NVIDIA graphics component. The driver contains a hardcoded list of 145 antivirus and endpoint security products and terminates any of them found on the device.

After disabling security products, the malware steals saved passwords from more than 25 browsers, including Chrome and Edge, and cryptocurrency wallet files from more than 30 wallet apps. It also takes Discord login tokens, Steam session tokens, Telegram session data, the Windows credential store, documents with words such as “password,” “seed,” “wallet” or “recovery” in their names, screenshots of every connected monitor and a detailed system profile.

The stolen information is compressed into a ZIP archive and uploaded to a server controlled by the attackers. The kernel driver also includes code to intercept web traffic, allowing attackers to inject ads or modify search results. Rapuncel installs itself as a Windows service that starts automatically at boot and loops continuously, checking for security products and killing them when they are activated.

Researchers said the machine may remain fully under the attacker’s control until the kernel driver is physically removed. That process requires booting into Safe Mode or using an external recovery tool, because normal Windows tools cannot safely remove software operating at that level while the system is running, they said.

LastPass and Delphos believe the campaign has been active for months and will continue after its current infrastructure is taken down. “The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned,” the researchers said. They described the operation as opportunistic brand impersonation and said LastPass systems and customer vaults have not been compromised or involved. LastPass said it was one of 40 companies spoofed in the campaign and urged users to download apps only from reputable, vetted sources.