The GitHub search was the installer

Someone Googled “LastPass Authenticator download.” GitHub was in the results. The page looked like a project. The ZIP was 148MB. That was the point.

LastPass and Delphos Labs published the campaign on 18 September. SEO-poisoned repositories impersonate the password manager and at least 39 other companies. Click Download, follow the redirects, land a padded archive. Inside is a renamed copy of Microsoft’s legitimate Visual Studio debugger, vsdbg.exe, told to sideload vsdbg.dll. That chain drops two things: an infostealer they call Rapuncel, and a kernel driver signed through Microsoft’s Hardware Compatibility Publisher.

The driver is renamed to look like NVIDIA (nvfsflt64.sys, service NvFsFilter). It opens processes as kernel and kills them. LastPass says the hardcoded list is 145 antivirus and EDR names. Protected Process Light does not help when the handle is opened as kernel code. The hash is not on Microsoft’s vulnerable-driver blocklist. VirusTotal was clean on the signature. Then the stealer runs.

What it takes

Browser passwords. Crypto wallets. Discord, Steam, Telegram. Windows Credential Manager. Files whose names contain password, seed, wallet, recovery. A screenshot of every monitor. Chrome and Edge app-bound encryption is bypassed by injecting into the browser and asking the Elevation Service from inside a process Google already trusts.

It comes back after reboot as a Windows service. Security tools that wake up get killed again.

This is not “a sketchy EXE from a forum.” It is a search result, a GitHub org that looks like a vendor, a Microsoft-signed driver, and a debugger you already allow because Visual Studio is software.

What to do with the laptop

If someone on the exec floor, or in IT, installed a password-manager “authenticator” from a GitHub repo they found in Google: do not run a second AV scan and call it contained. A kernel driver that already beat PPL is not something Windows Defender will politely uninstall.

Take the machine offline. Treat every browser session and every wallet on that box as stolen. Rotate from a different device. The password manager they thought they were installing is the one account you rotate last, after the sessions, not first.

Helpdesk asking “did you download it from GitHub or from lastpass.com” is the useful question. “GitHub was in the first page of Google” is a yes.

Do not restore from the same disk. The service will start again.