Attackers are running a campaign that plants counterfeit GitHub repositories, tuned to rank well in search results, that masquerade as tools from recognized software companies such as a LastPass authenticator. Victims who download them get infected with a newly identified information-stealing malware dubbed Rapuncel, which harvests data from their devices. Consumers looking for legitimate security apps are the main targets.
Read the full story at Bleeping Computer