Fake LastPass Authenticator Pages Deliver Rapuncel Infostealer

Researchers said they recently uncovered and disrupted a malware campaign using fake GitHub pages to impersonate dozens of companies – including LastPass – and distribute the Rapuncel infostealer. This malware systemically attempted to disable security tools on victim’s systems before stealing “everything of value,” from credentials to crypto wallet files. 

The campaign started with GitHub pages impersonating real companies, which were SEO-optimized and ranked high in search results. One of those pages (github[.]com/LastPass-Authenticator) mimicked LastPass Authenticator, a popular mobile app that provides push notifications to verify user identities when logging into accounts.

“The joint analysis revealed a larger operation with its own infrastructure, crypter kit to evade detection, and multiple operators running lures in parallel targeting dozens of other companies,” according to LastPass and Delphos in an analysis released last week. “The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned.”

When victims pressed a button to download “LastPass Authenticator,” they were taken to a GitHub Pages site (lastpass-authenticator[.]github[.]io) telling them that the app is “Preparing download” with a spinning animation. In the background, however, they were being routed through a multi-stage redirect chain involving multiple GitHub Pages accounts, which helped attackers hide their infrastructure. 

“These pages don't display anything visible to the user and exist to obscure the trail between the lure page and the actual malware server, making the infrastructure harder to trace and take down,” according to the analysis. “Each one uses a custom 404.html file containing JavaScript that captures the URL path and silently forwards the victim to the next stage. This technique exploits standard GitHub Pages error-handling behavior to function as a covert redirector while appearing to be a broken or nonexistent page.”

Victims were eventually sent to the attacker’s payload server (albinofennel[.]com or hanselarinmusky[.]com). Researchers found that albinofennel[.]com was serving at least 40 other branded impersonation lure pages.

After the malware was installed, it would attempt to take full admin-level control, before installing a kernel driver disguised as an NVIDIA graphics component in order to attempt to kill security tooling on the victim’s system. The malware then stole browser passwords (with the capability to read saved passwords for more than 25 browsers). The malware would also collect crypto wallet files, Discord login tokens, Steam session tokens, Telegram session data, Windows credential store (which could help saved passwords and Windows Hello data), any document with a name containing words like “password” or “wallet”, and more.

Due to its popularity and the sensitive nature of the data it holds, attackers frequently target LastPass in various campaigns. In March, attackers sent spoofed LastPass emails containing fake internal-looking account-security conversations, directing victims to a fraudulent LastPass login page designed to steal their credentials. And in January, threat actors sent fake LastPass emails claiming urgent server maintenance required users to back up their vaults within 24 hours, directing them to phishing sites designed to steal credentials.

For this most recent campaign, researchers stressed that GitHub is not a LastPass distribution channel.

“This was opportunistic brand impersonation,” according to the analysis. “No LastPass system, service, or customer vault was involved or compromised. The lure was distributed entirely outside LastPass channels. Official LastPass Authenticator is available through lastpass.com and the official app stores.”