Fake LastPass Authenticator Spreads Rapuncel Malware

Attackers spoofed LastPass Authenticator via SEO-poisoned GitHub pages, delivering a ZIP that sideloads the Rapuncel malware. It kills 145 antivirus products, steals passwords from 25 browsers and crypto wallets, and persists as a Windows service. LastPass says its vaults are unaffected, but the campaign has run for months and spoofed 40 companies.