A new malware campaign is abusing GitHub's trust by creating fake repositories that impersonate popular software, including LastPass Authenticator. The repositories are engineered to rank well in search engine results, luring users who are looking for legitimate downloads. Once a user accesses one of these pages, they are directed to install what appears to be a genuine tool but is actually a previously unknown information stealer called Rapuncel.
Rapuncel is designed to harvest sensitive data from infected systems, though the full scope of its capabilities is still being analyzed. The campaign's reliance on SEO poisoning and GitHub's infrastructure makes it particularly insidious, as users often assume repositories from the platform are safe. Security researchers urge caution when downloading software from links found via search engines, even if they appear to come from official-looking GitHub pages.
The source notes that this is an ongoing campaign, with the fake repos actively pushing the malware. No further technical details about Rapuncel's inner workings were disclosed in the report, but its emergence highlights the growing trend of using trusted developer platforms as distribution channels for malicious code.