A fake LastPass Authenticator app is spreading through poisoned search results, and once installed it disables your antivirus before robbing you blind.
Attackers built a GitHub page that closely mimics LastPass's real Authenticator download and pushed it up the rankings for searches like "LastPass Authenticator download," according to LastPass. Clicking through delivers a ZIP file containing a renamed copy of a legitimate Microsoft debugging tool alongside a malicious DLL, a technique called DLL sideloading that lets the trusted executable launch the attacker's code instead of its own. The payload, named Rapuncel by researchers at Delphos, grabs SYSTEM-level access and installs a kernel driver disguised as an NVIDIA component, which hunts down and kills any of 145 antivirus and endpoint-security products it finds. With defenses gone, it steals saved passwords from more than 25 browsers, files from over 30 crypto wallet apps, Discord and Steam tokens, Telegram session data, Windows credential store entries, and screenshots, then uploads everything to the attackers' server.
Killing the driver is not a quick fix. Researchers say it requires booting into Safe Mode or using external recovery tools, because normal Windows software cannot safely remove something running at that privilege level while the system is on. LastPass says its own vaults were never touched, but it was just one of roughly 40 brands impersonated in what researchers call a months-long campaign that shows no sign of stopping once this particular infrastructure gets shut down.
A convincing GitHub clone outranking the real download page is the actual story here. "Only download from official sources" is good advice that gets harder to follow every year search results get better at lying.