SecurityWeek reports that attackers are distributing fake LastPass installers as part of a campaign that impersonates at least 40 companies. The malicious installers are designed to disable endpoint detection and response (EDR) tools before delivering their payload.
The malware includes a kernel-level EDR killer that targets 145 security products, giving it deep access to bypass protections. After disabling these defenses, the campaign drops an infostealer known as Rapuncel, which is used to harvest sensitive data from compromised systems.
The use of a kernel-level component and broad impersonation suggests a well-resourced operation aimed at evading enterprise security controls. Users should obtain software only from official sources and treat unsolicited installer files with caution.