Rapuncel infostealer is being distributed through a documented malware campaign that uses fraudulent GitHub organizations and software-download pages designed to look like legitimate brands. LastPass Threat Intelligence, Mitigation, and Escalation researchers and Delphos Labs reported that the infrastructure supported at least 40 branded impersonation lures and could deliver a multi-stage Windows infection chain that steals credentials and other sensitive data.
Direct answer: Seeing or visiting a fake GitHub page is not the same as proving your device was infected. The important transition is whether you downloaded and executed the attacker-provided installer. If it ran, the observed Rapuncel chain could disable security processes and steal browser credentials, sessions, wallet data and other sensitive information.
What the Rapuncel campaign actually did
The primary research describes fraudulent GitHub organizations and branded lure pages that imitated trusted software companies. Users searching for software could be redirected through attacker-controlled infrastructure toward oversized archives or fake installers. The campaign then used DLL side-loading and additional payloads to establish the malware chain.
The researchers tracked the credential-stealing malware as Rapuncel. The operation also used a kernel driver that had passed Microsoft attestation signing. In the observed chain, the driver was used to terminate security processes before the infostealer continued its activity.
Was LastPass hacked?
No. The LastPass research explicitly states that the lure infrastructure operated outside LastPass systems and that LastPass services, infrastructure and customer vaults were not compromised by this campaign. The attackers were abusing the company’s brand, not operating from inside LastPass.
The same distinction matters for GitHub. The documented campaign used fraudulent organizations and repositories hosted on or associated with GitHub as delivery lures. That is not evidence that GitHub itself was breached.
How to decide whether you were exposed
Simply visiting a suspicious branded GitHub page is not established by the reviewed evidence as equivalent to infection. Do not download or execute the offered software.
Delete the untrusted file, avoid opening it and verify the software vendor’s real distribution channel before downloading again.
Treat the event as a possible endpoint compromise. The observed chain could load additional components, interfere with security tooling and steal sensitive credentials and data.
Escalate through your organization’s incident-response process or use a trusted clean system for recovery. Do not assume that removing one file proves the endpoint is clean.
What the signed driver means
The presence of a Microsoft-attested signature did not make the analyzed driver safe. The researchers found that the loader carried a fixed list of 145 antivirus and endpoint-security process names that it attempted to terminate. This is an important trust lesson: code signing establishes information about the signing chain, but it is not by itself proof that a component is benign.
The analysis also found additional capabilities in the driver, but the report said some broader features were not configured or active in the observed deployment. TPS therefore does not describe every capability present in the driver as something Rapuncel definitely used against victims.
What Rapuncel can steal
The researched payload targeted sensitive data including browser credentials and session-related material, cryptocurrency wallet information, messaging and gaming data, and Windows Credential Manager content. That creates both account-takeover and financial risk if the malware successfully executes.
What to do if you ran the fake installer
If execution occurred, isolate the affected system according to your normal security or incident-response procedure and treat credentials stored or used on that machine as potentially exposed. The primary researchers advise changing credentials from a separate known-clean device rather than from the potentially compromised endpoint.
TPS already maintains a separate recovery guide for the broader post-infostealer question of which passwords, tokens and secrets may need rotation: Infostealer Infection: Which Passwords, Tokens and Secrets Must You Rotate?
Do not rely on one hash, domain or scan result
The published indicators are useful for investigation, but the primary research warns that campaign infrastructure and payloads can rotate. A clean scan result, a familiar brand name, a GitHub-hosted page or a signed component should not be treated as sufficient proof that a download is trustworthy.
For verification, compare the software link with the vendor’s real website and established distribution channels, and investigate unexpected redirects, oversized archives, unusual installer chains or security-tool interference before trusting the file.
What remains unknown
The reviewed evidence does not establish how many users were infected, the complete list of all impersonated brands, whether every GitHub organization or domain observed during the investigation remains active today, or the final identity of the campaign operators. TPS also does not treat the reported 40-brand scale as evidence that those companies themselves were compromised.
What to watch next
This article should be updated on the same URL if GitHub removes additional infrastructure, Microsoft changes the driver blocklist or signing state, researchers identify new Rapuncel payloads or command-and-control infrastructure, confirmed victim telemetry appears, or LastPass and Delphos publish revised remediation guidance.
Verification note: TPS reviewed the LastPass TIME and Delphos Labs primary threat research and reconciled the core campaign claims against current cybersecurity reporting. The fake-GitHub distribution chain, Rapuncel credential theft, signed-driver behavior and explicit statement that LastPass itself was not compromised are supported; current infrastructure and infection scale remain unresolved.