Fake LastPass downloads on GitHub pushed password-stealing malware

A malware campaign impersonates LastPass on GitHub to trick users into installing an information stealer that can harvest browser passwords, cryptocurrency wallets, and messaging app sessions.

The campaign, detailed in a report by LastPass and Delphos Labs, used fake GitHub pages designed to appear in search results for terms such as “LastPass Authenticator download.” Investigators found that the same infrastructure was being used to impersonate at least 40 companies.

LastPass first detected the operation on August 13, 2026, after identifying a fraudulent GitHub organization at github[.]com/LastPass-Authenticator. The page copied LastPass branding and directed visitors to another GitHub-hosted download portal containing fabricated security claims such as “VirusTotal Approved” and “Secure Archive.”

LastPass is a password management provider whose products store and protect credentials across websites and applications. The company stressed that its own systems, services, and customer vaults were not compromised, and that GitHub is not an official distribution channel for LastPass Authenticator.

Behind the fake download page was a chain of redirects involving additional GitHub Pages accounts and attacker-controlled domains. This setup allowed the operators to change the final malware server without rebuilding the visible LastPass lure.

Victims ultimately received ZIP archives as large as 148 MB. Much of that size came from junk data, which researchers believe was intended to exceed file-size limits used by some automated malware scanners.

Running the supposed LastPass installer triggered a multi-stage infection. The malware abused a legitimate Microsoft debugging executable, vsdbg.exe, to load a malicious DLL through DLL side-loading.

The infection then installed a kernel driver researchers call Alinubx.sys, disguised on infected machines as an NVIDIA component. According to the analysis, the driver contained a list of 145 antivirus and endpoint security processes that it could terminate from kernel mode.

Notably, the driver was signed through Microsoft's Windows Hardware Compatibility Publisher chain and initially showed no detections on VirusTotal. Researchers linked it to the CnCrypt/CcProtect driver family, whose process-termination functionality has previously been documented as useful for bring-your-own-vulnerable-driver attacks.

Once security software was disabled, an information stealer tracked by LastPass as Rapuncel collected credentials from numerous browsers and cryptocurrency wallets, along with Discord tokens, Steam credentials, Telegram session data, Windows Credential Manager contents, screenshots, and potentially sensitive documents.

The malware also included a method for bypassing the app-bound encryption used by Chrome and Edge by injecting code into the browser and requesting decryption from inside the trusted browser process. The malware then compressed stolen information and uploaded it to attacker-controlled infrastructure.

Researchers said the operation shows similarities to the BoryptGrab campaign documented by Trend Micro earlier this year. However, available evidence is insufficient to conclude that the same group operated both campaigns.

Anyone who ran the fraudulent installer should treat credentials and session data stored on the affected computer as compromised. Change passwords from a separate, trusted device, revoke active sessions where possible, and secure cryptocurrency wallets. Because the campaign installs a kernel-level driver, affected systems may also require offline or Safe Mode remediation rather than relying solely on conventional antivirus cleanup.