Oversized ZIP download impersonating LastPass Authenticator installer

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•0

Detection of network traffic associated with the delivery of the Rapuncel information stealer. The rules monitor for large ZIP archives masquerading as LastPass Authenticator installers and detect attempts to reach out to external domains for DLL sideloading artifacts (TitanStorage.dll and ProManager.dll).