A new malware campaign is using SEO-optimized GitHub repositories to impersonate the LastPass Authenticator app.