Rapuncel Abused Familiar Trust Marks
Search-optimised GitHub lures impersonated 40 or more brands. LastPass says its service and vault were unbreached. Its investigation with Delphos found a Windows driver under Microsoft attestation killing 145 named security processes.
Browser credentials and wallet material were targeted. Driver hiding, injection and traffic redirection remained unconfigured in the observed sample. Code capability establishes neither deployment nor victim impact.
Signature checks establish signing provenance, never harmless behaviour.
Check the trust chain
- Obtain applications through verified vendor channels.
- Control driver loading through tested allowlists and blocking; confirm compatibility.
- Investigate simultaneous endpoint-monitor failures.
- Inspect the entire machine; replacing an application leaves kernel persistence and stolen sessions unresolved.
- Rotate reachable browser tokens, wallet keys and development secrets from a clean device, guided by exposure evidence.
- Hunt driver loads, process killing and credential access; names and domains change.
Research: 17 September 2026. Follow-up: 18 September 2026, 11:19 displayed; timezone unspecified.
