An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.

LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.

Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.