Fake GitHub Repos Are Pushing Infostealers at Your Staff

What happened

BleepingComputer reports that an active malware campaign is using search-engine-optimized GitHub repositories to impersonate well-known software companies, including fake versions of the LastPass Authenticator app. The repos are built to rank well and look legitimate, and the payload is a previously undocumented information stealer that researchers have named Rapuncel. You can read the original reporting here: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer.

The important detail is the delivery method, not the brand being spoofed. Attackers are not breaking into anything; they are publishing convincing-looking projects on a platform your staff already trusts and waiting for search traffic to do the work. Public reporting on this campaign is still developing, so treat specific indicators, file hashes, and the full list of impersonated vendors as things to verify with your security provider rather than assume. What is clear enough to act on today is the pattern: employee searches for a tool, employee lands on a repo, employee runs an installer, credentials and session tokens leave the building.

Why this matters for Pittsburgh small and mid-sized businesses

At 10 to 200 employees, you almost certainly have people installing their own software. Not maliciously — a paralegal needs a PDF splitter before a filing deadline, a controller wants a CSV cleanup utility during close, a shop-floor engineer needs a driver or a serial terminal for a machine. In firms this size, the person with local admin rights is often the same person under the most time pressure, and "first result that looks official" is a reasonable-seeming decision at 4:45 on a Friday.

Infostealers are particularly nasty for our client base because of what they take. They scrape browser-saved credentials, cookies, and authentication session tokens. A stolen session token can let an attacker into Microsoft 365 without ever needing the password or the MFA prompt, which is exactly how so many Pittsburgh-area business email compromise cases begin — a quiet mailbox rule, a few weeks of watching, then a fraudulent wire instruction sent from a real address during a real transaction. For accounting and CPA firms mid-season, or a law firm handling a closing, the timing risk is obvious.

Then there is the compliance layer. A stolen credential that touches ePHI puts a healthcare practice into HIPAA breach-assessment territory, and "we could not determine what was accessed" is the worst possible answer. Financial services firms and anyone under FTC Safeguards owe demonstrable access controls and monitoring, not just good intentions. And for our defense-contractor clients, a workstation that handles CUI is not a place where anyone should be installing unvetted binaries from a public repo — CMMC Level 2 assessors will ask how software installation is controlled, and a shrug is a finding.

Manufacturers face a different flavor of the same problem: a single engineering laptop with saved VPN credentials and vendor portal logins can be the bridge between the office network and production systems that cannot tolerate downtime.

What to do about it this week

1. Send a short, specific staff notice today. Not a generic "be careful online" email. Tell people that fake code repositories impersonating real software vendors are actively distributing credential-stealing malware, that MFA and password manager apps should only ever be downloaded from the vendor's own website or an official app store, and that search results and GitHub links are not proof of legitimacy.
2. Remove standing local administrator rights. This is the single highest-value change most firms your size have not finished. If users cannot install software, the majority of drive-by tool downloads simply fail. Pair it with a documented, fast approval path so the paralegal with the deadline gets a real answer in minutes, not a policy lecture.
3. Verify your endpoint coverage is actually complete. Confirm that every workstation and laptop — including the machines someone bought outside of procurement — is reporting into your EDR or MDR console, and that alerts are monitored by a human after hours. Coverage gaps, not detection failures, are what usually bite.
4. Hunt for stolen-session abuse in Microsoft 365. Review sign-in logs for impossible-travel and unfamiliar-device sign-ins, audit for suspicious inbox forwarding and mailbox rules, and shorten token lifetimes where feasible. Adding sign-in risk policies and device compliance requirements in Microsoft 365 meaningfully reduces what a stolen token is worth.
5. Force a credential reset for anyone who may have installed software from a repo recently. Ask the question directly in the staff notice. If someone raises a hand, reset their passwords, revoke active sessions and refresh tokens, and check what that account could reach — don't just scan the machine and move on.
6. Stop storing business passwords in the browser. Browser credential stores are a primary infostealer target. Move staff onto a managed password manager with enforced MFA and clear out saved passwords from Chrome and Edge profiles.
7. Write down your software-install rule and your AI-tool rule in the same sitting. The same "I found a helpful tool online" instinct is driving unsanctioned AI usage right now. A one-page acceptable-use policy that covers both, with an approved-tools list, is far more effective than two separate documents nobody reads. Our AI advisory work usually starts exactly here.

None of these require new spend. Items 1, 2, 5, and 6 are policy and configuration work you could start Monday and finish this week.

How we help

PGH Networks handles the unglamorous controls that make this campaign a non-event: application and admin-rights control, patch management and endpoint monitoring, Microsoft 365 identity hardening, and evidence collection that maps to the frameworks you actually answer to. If you are unsure who on your team has local admin, whether your EDR covers every device, or how you would prove what an attacker touched, our vCIO team can walk that with you and build it into your roadmap.

Call 724.888.7007 or reach us through the contact form and we will review your endpoint and identity posture against this threat pattern.