> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer - URL: https://f4n6.co.uk/security-feed/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/ - Published: 2026-09-21T21:38:39.000Z - Updated: 2026-09-21T21:38:39.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary An active malware campaign distributes fake LastPass installer packages that deliver a kernel-level component capable of disabling 145 security products, followed by deployment of an infostealer tracked as "Rapuncel". The operators impersonate at least 40 legitimate companies to distribute the malicious installers. No verified reference data resolved for this item, so no CVSS scoring, CISA-KEV status or MITRE attribution can be stated; the campaign name and all technical detail below are single-sourced to one SecurityWeek report. The bottom-line risk for EMEA financial services is credential theft from password-manager users and the possibility that endpoint protection is silently disabled before exfiltration begins. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The campaign is a general malware-distribution threat without a confirmed incident at a financial entity, a named ICT third-party failure, or a reportable event in the source material; generic mappings to incident reporting would fit any security incident and are not made here. ## 3\. Technical analysis & attack chain The source material for this item is a single SecurityWeek summary of 21 September 2026\. It contains no CVE, no hash, no domain, no command line and no file path. Everything below is single-sourced and should be verified against the underlying vendor research before enforcement action. Confirmed from the source: 1. Attackers impersonate at least 40 companies, including LastPass, to distribute fake software installers. 2. The fake installers carry a kernel-level component that disables 145 security products. 3. After endpoint protection is disabled, the operators deploy the "Rapuncel" infostealer. That is the full extent of the confirmed detail. The source does not state the initial access vector beyond installer impersonation (malicious advertising, SEO poisoning, phishing or a mix are all consistent with the description and none is confirmed), the privilege requirement for the kernel component, the persistence mechanism, command-and-control infrastructure, or what data Rapuncel targets. The number of disabled security products, 145, implies the component carries a broad kill list of EDR and antivirus processes and drivers, but the source does not enumerate them. The campaign name "Rapuncel" and the vendor attribution behind the report cannot be corroborated here; no related sources were available. Treat the actor as unidentified. ## 4\. Mitigation & containment P1 (within 24h): - Block execution of software installers downloaded outside your approved software-distribution channel, specifically including LastPass, using application control (Windows AppLocker / WDAC or equivalent). The distribution vector is fake installers, so the control point is installer provenance, not a hash. - Search endpoint telemetry for LastPass installer binaries obtained from outside your sanctioned source in the past 30 days and quarantine any matches. - Confirm your EDR tenant is healthy across the estate: agent check-in rates, tamper-protection status and process-protection features. A kernel-level kill component defeats agents whose self-protection is off. P2 (within 72h): - Warn helpdesk and staff that LastPass and other consumer software installers are being impersonated, and route software requests through the standard request process. Name the behaviour (fake installers from search results or unsolicited links) rather than only the LastPass brand, since at least 40 companies are impersonated. - Verify that tamper protection and kernel-level self-protection are enforced by policy on all endpoints, not merely available. P3 (within 7 days): - Review software-request and installation telemetry for a baseline of what legitimate installer traffic looks like on your estate, so deviations are detectable next time. No vendor fix, patch or version pin applies; this is a distribution campaign, not a product vulnerability. LastPass itself is not reported as compromised. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source names no hashes, domains, IPs, URLs, file names or registry keys. Atomic indicators will follow in a revision once the underlying vendor research is obtained. ## 6\. Detection Insufficient indicators to author detection rules. The source contains no strings, file names, command lines, mutexes, registry keys or other artefacts of the malware itself; a rule built from the campaign name or the LastPass brand would detect reporting about the threat, not the threat. ## 7\. Sources - SecurityWeek, "Fake LastPass Installers Push Kernel-Level EDR Killer, 'Rapuncel' Stealer", https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/, 2026-09-21 ## 8\. Adverse Trace position We assess this as a credible but thinly documented campaign: the mechanism (fake installers, kernel-level security-product disabling, infostealer deployment) is a known and damaging pattern, but every specific in this item rests on a single summary article with no underlying technical report, no indicators and no attribution. We are not changing client risk ratings on this basis alone. We will obtain the primary vendor research, extract the 145-product kill list and any installer indicators, and issue a revision with detection content; until then, treat the P1 installer-provenance controls above as the actionable output. --- [Read the original source →](https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*