Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

As cited

Copy frozen at 2026-09-21 17:09 UTC (site build).

threat intel

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

Threat actors impersonating at least 40 companies distribute counterfeit LastPass installers that deploy a kernel-level endpoint detection and response (EDR) killer and Rapuncel stealer malware. The malicious packages disable 145 security products to facilitate information theft.

Why it matters: Organizations and individuals downloading LastPass from unofficial sources face immediate risk of EDR bypass and credential theft; practitioners should verify software authenticity and block known malicious installer sources.

Source published

2026-09-21 15:46 UTC

First seen by Cybersecurity Tracker

2026-09-21 15:53 UTC