Listen to the episode
TLDR
An active malware campaign is poisoning Google search results with SEO optimised fake GitHub repositories that impersonate well known software vendors, including LastPass Authenticator and at least 39 other brands. Users who click the fake...
How it works
An active malware campaign is poisoning Google search results with SEO optimised fake GitHub repositories that impersonate well known software vendors, including LastPass Authenticator and at least 39 other brands. Users who click the fake...
Red flags
- A GitHub repo offering downloads for a major brand's authenticator or paid tool Sponsored or promoted search results that disagree with the vendor's official site URL Installer archives inflated to 100+ MB to dodge sandbox scanning
What to do
- 1Always download software from the vendor's official domain, never from third party repos Ignore sponsored Google results for software downloads
- 2scroll to the official listing Verify GitHub repo ownership, co
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/FAQ
Is Fake GitHub repos impersonate LastPass and 39 brands to push Rapuncel infostealer a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
A GitHub repo offering downloads for a major brand's authenticator or paid tool Sponsored or promoted search results that disagree with the vendor's official site URL Installer archives inflated to 100+ MB to dodge sandbox scanning
What should I do first?
Always download software from the vendor's official domain, never from third party repos Ignore sponsored Google results for software downloads; scroll to the official listing Verify GitHub repo ownership, co
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.