The attackers set up fake repositories that appear in search results for popular security and authentication tools, tricking users into downloading what they believe is legitimate software. Once executed, the payload deploys the Rapuncel infostealer, which is designed to harvest sensitive data from compromised systems.

Key points for defenders:

• The campaign relies on GitHub repositories that are optimized for search engines, making malicious results rank prominently for brand-related queries.
• LastPass Authenticator is among the impersonated products, alongside other well-known software firms.
• The delivered malware, Rapuncel, was previously undocumented prior to this campaign.
• Users searching for legitimate download links may be redirected to attacker-controlled repositories hosting the stealer.

To reduce exposure, security teams and end users should:

• Only download software from official vendor websites and verified distribution channels.
• Treat GitHub search results with caution when looking for branded installers or authenticator apps.
• Monitor endpoints for unexpected executable downloads originating from repository links.
• Educate users on typosquatting and SEO-poisoning tactics used in these campaigns.

Source: Unknown

Has anyone in the community observed fake GitHub repos pushing Rapuncel or similar stealers in their environment?