As reported by SecurityAffairs, a malware-as-a-service operation impersonating at least 40 companies on GitHub—including a convincing fake LastPass Authenticator—delivered an infostealer tracked as Rapuncel that used a Microsoft Windows Hardware Compatibility Publisher-signed driver to disable 145 antivirus and EDR products before exfiltrating data. LastPass's TIME team identified the campaign on August 13, 2026, and Delphos Labs confirmed the payload survived multiple layers of trust verification, including a clean VirusTotal score.

Threat Alert: While the GitHub impersonation and fake trust badges make for a compelling narrative, the technical centerpiece of this attack is the use of a legitimately Microsoft-signed driver to terminate security tooling.

The Brand Spoofing Is a Distraction—The Driver Abuse Is the Real Threat

While the GitHub impersonation and fake trust badges make for a compelling narrative, the technical centerpiece of this attack is the use of a legitimately Microsoft-signed driver to terminate security tooling. This is a Bring Your Own Vulnerable Driver (BYOVD) technique: the attacker ships a real, signed kernel driver—often one with known vulnerabilities or excessive capabilities—and uses its legitimate kernel access to manipulate or kill EDR processes, callback registrations, and minifilter drivers that security products rely on.

The fact that the driver carried a Windows Hardware Compatibility Publisher signature chain means it passed Microsoft's WHQL signing requirements at some point. Signature revocation is reactive and slow. By the time a blocklist entry propagates, the driver has already been loaded on victim machines. This is not a new problem—we've seen it with RTCore64.sys, gdrv.sys, iqvw64e.sys, and others—but the scale here (145 products neutralized) suggests the kit's driver-selection and capability-mapping is more mature than typical commodity malware.

The most dangerous aspect of this campaign isn't that attackers spoofed a trusted brand. It's that they leveraged Microsoft's own trust infrastructure to bypass the exact controls designed to stop them.

GitHub as a Malware Distribution Surface

The use of GitHub Pages and fake GitHub organizations as delivery infrastructure is escalating. GitHub's domain reputation means links pass through email security gateways, browser reputation checks, and corporate web filters without friction. The campaign's use of intermediate GitHub Pages accounts disguised as 404 error pages—using JavaScript to silently redirect—demonstrates a deliberate effort to evade automated URL analysis and sandbox detonation.

Organizations should treat GitHub.com and github.io with the same scrutiny applied to any user-generated content platform. The presence of a GitHub URL in a download chain is not a trust signal.

Who Is Most at Risk

GitHub as a Malware Distribution Surface
Individual users and small teams who search for software downloads via Google rather than using official app stores or vendor websites
Organizations without driver blocklist enforcement (Microsoft Vulnerable Driver Blocklist not enabled or not enforced via GPO/MDM)
Environments relying solely on signature-based EDR without behavioral tamper protection or kernel callback integrity monitoring
Remote and hybrid workers who may download productivity and security tools outside IT-managed channels

Shield53 Recommendations

Immediate Actions

  • Enable the Microsoft Vulnerable Driver Blocklist across all Windows endpoints via Group Policy or Microsoft Intune. This is not enabled by default on all Windows versions and must be explicitly configured.
  • Audit EDR tamper protection—ensure tamper protection is enabled in your endpoint platform and verify that kernel driver load events are being logged and alerted on.
  • Deploy driver load monitoring rules—alert on any non-precedented driver load, especially drivers loaded from user-writable directories like Downloads, Temp, or AppData.
  • Block github.io and GitHub release download URLs at the web proxy for non-developer user groups, or require approval workflows for direct binary downloads from GitHub.

Strategic Actions

  • Implement application allowlisting (WDAC or AppLocker) to restrict executable execution from user-writable locations.
  • Brand monitoring for your organization—set up alerts for fake GitHub organizations, lookalike domains, and impersonation on package registries (npm, PyPI, GitHub). This campaign hit 40+ brands; yours could be next.
  • User awareness training should specifically address the "search engine → GitHub → download" attack pattern and the meaninglessness of third-party trust badges like "VirusTotal Approved."
  • Hunt for Rapuncel IOCs in your environment—search for driver loads from non-standard paths, EDR service stop events, and unexpected credential store access patterns consistent with infostealer exfiltration.

The Rapuncel campaign underscores a structural problem: our trust chains are only as strong as their weakest link, and right now, driver signing and GitHub's domain reputation are both being systematically abused. Defenders need to stop treating signed binaries and reputable domains as sufficient trust signals and start validating behavior at the kernel and network layers.