Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos

Key facts for Rapuncel Alinubx EDR killer

Detection coverage for Rapuncel Alinubx EDR killer

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2602 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Renamed vsdbg.exe Executing from User-Writable Path with Companion vsdbg.dll Side-Load

Detects execution of a binary named vsdbg.exe (Microsoft's Visual Studio CoreCLR Debugger) launched from a Downloads/Temp/Desktop path outside the standard Visual Studio install tree, immediately followed by an image-load of a co-located vsdbg.dll on the same process. This is the Rapuncel/BoryptGrab-lineage loader mechanism delivered after victims are funneled through fake GitHub 'LastPass Authenticator' download pages.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1574.002, T1036.005
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval proc_name=lower(mvindex(split(Image, "\\"), -1))
| where proc_name="vsdbg.exe"
| where NOT match(Image, "(?i)\\\\Program Files\\\\Microsoft Visual Studio\\\\|\\\\Common7\\\\IDE\\\\")
| where match(Image, "(?i)\\\\Downloads\\\\|\\\\AppData\\\\Local\\\\Temp\\\\|\\\\Desktop\\\\")
| join type=inner ProcessGuid
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7
      | where match(lower(ImageLoaded), "vsdbg\.dll$") ]
| table _time, Computer, User, Image, CommandLine, ImageLoaded, Hashes
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "vsdbg.exe"
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\Desktop\\")
| where FolderPath !has @"\Program Files\Microsoft Visual Studio"
| join kind=inner (
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "vsdbg.dll"
) on $left.ProcessId == $right.InitiatingProcessId, $left.DeviceId == $right.DeviceId
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine, SHA256

Sigma

title: Renamed Visual Studio CoreCLR Debugger (vsdbg.exe) Side-Loading vsdbg.dll from User Path
id: 7a2e4b6c-1f0d-4a3e-9c8b-0e1f2a3b4c5d
status: experimental
description: Detects vsdbg.exe executing from a non-standard, user-writable directory and immediately loading a co-located vsdbg.dll, matching the Rapuncel/BoryptGrab-lineage loader technique delivered via fake GitHub "LastPass Authenticator" repositories.
references:
    - https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer
    - https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1574.002
    - attack.t1036.005
logsource:
    category: image_load
    product: windows
detection:
    selection_proc:
        Image|endswith: '\vsdbg.exe'
    filter_legit_path:
        Image|contains:
            - '\Program Files\Microsoft Visual Studio\'
            - '\Common7\IDE\'
    selection_userpath:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
    selection_dll:
        ImageLoaded|endswith: '\vsdbg.dll'
    condition: selection_proc and not filter_legit_path and selection_userpath and selection_dll
falsepositives:
    - Developers running a portable/manually-copied CoreCLR debugger outside the standard Visual Studio install path
level: high

Known false positives:

• Developers manually placing/running a portable copy of the Visual Studio CoreCLR debugger outside its normal install path (rare in enterprise environments)

Tuning notes: Baseline legitimate developer workstations that intentionally copy vsdbg.exe outside Program Files (e.g., remote-debugging containers) and exclude their hostnames; tighten by requiring the parent process to be a browser, archive-extraction utility (7z.exe, WinRAR.exe), or Explorer.exe to reduce noise from CI/build agents.

• 🔒 Oversized ZIP Download from Rapuncel Lure/Redirect Domain Followed by vsdbg.exe Execution · unlock with TL Creds
• 🔒 Chrome/Edge Elevation Service DecryptData Abuse for App-Bound Encryption Bypass · unlock with TL Creds
• 🔒 Network Contact with Rapuncel/BoryptGrab Redirect and Payload Infrastructure Domain Set · unlock with TL Creds
• 🔒 GitHub Pages Brand-Impersonation Relay Resolving Rapuncel Redirect/Payload Infrastructure · unlock with TL Creds
• 🔒 Alinubx.sys EDR-Killer Driver Disguised as NVIDIA Filesystem Filter Driver · unlock with TL Creds
• 🔒 Chrome Extension-Integrity Registry Key Deletion with Concurrent Archive Staging · unlock with TL Creds
• 🔒 NvFsFilter Kernel Driver Registration with Mass AV/EDR Process-Termination Burst (Alinubx.sys) · unlock with TL Creds
• 🔒 Raw-TCP HTTP POST /upload Exfiltration Beacon to Hardcoded Rapuncel C2 ([indicator]) · unlock with TL Creds

Indicators of compromise for Rapuncel Alinubx EDR killer

As of 2026-09-21, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-2602.

Sample indicators (3 of 31)

• IP address: 2.26.126[.]50
• Domain: istatlmenus[.]com
• URL: hxxps://github[.]com/LastPass-Authenticator

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

How Rapuncel Alinubx EDR killer works

The installer sideloads its payload via a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe), then Rapuncel harvests credentials from 25+ browsers (including Chrome/Edge app-bound encryption via injected-DLL bypass), 30+ cryptocurrency wallets, Discord/Steam/Telegram session data, and Windows Credential Manager contents.

LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team, working with Delphos Labs, identified a malware-as-a-service (MaaS) distribution kit that impersonates at least 40 companies — including LastPass Authenticator — through fraudulent GitHub organizations (github.com/LastPass-Authenticator, github.com/LastPass-S) and GitHub Pages download portals (lastpass-authenticator.github.io) that rank in search results for terms like "LastPass Authenticator download." Victims are funneled through hidden GitHub Pages relay accounts (edgarcostartqd.github.io, dallikilic54.github.io) whose 404.html pages silently forward traffic through a Cloudflare-fronted redirect layer (istatlmenus.com), which dynamically supplies the current payload-server address at runtime via its /mandua.wonted endpoint — letting the operators rotate infrastructure without touching the lure pages. The final payload is served from one of several rotating domains (albinofennel.com, hanselarinmusky.com, icansamyope.com) as an intentionally bloated ZIP archive (up to 148MB, padded with junk files) designed to exceed the size limits of automated sandbox scanners.

Inside the archive, a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe) is used to side-load a malicious companion DLL (vsdbg.dll, SHA256 ea8c31a8...) built with a .NET NativeAOT runtime — a hardening choice that removes the easy IL-decompilation path defenders expect from Mono/.NET samples. Delphos assesses with high confidence that this loader was produced by the Cruciferra PUROSANGUE crypter package or a close derivative, based on matching .reloc-section payload storage, a custom Base16 encoding scheme, and an embedded build-path string (C:\ExploitTests\purosangue.tx).

The loader installs two components: the Rapuncel infostealer (SHA256 aefbc6e0...) and a kernel driver, Alinubx.sys (SHA256 611b3ba6...), dropped to disk as nvfsflt64.sys and registered as the "NvFsFilter" service, masquerading as an NVIDIA File System Filter Driver. The driver is in fact a renamed/repurposed build of CcProtect.sys v1.32, a legitimate host-defense driver from Henan Dafeng Software Co., Ltd.'s CnCrypt disk-encryption product — carrying a valid Microsoft Windows Hardware Compatibility Publisher signature chain (timestamped March 2023) and, as of the investigation, 0/72 VirusTotal detections and no entry on Microsoft's vulnerable-driver blocklist. The driver contains a hardcoded table of 145 antivirus/EDR process names and terminates them by calling ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time — defeating Protected Process Light (PPL) protections that many security products rely on to survive termination attempts by an administrator-level process. The driver exposes this kill function via IOCTL 0x222024 against device \\.\Alinubx; a second, unused IOCTL (0x222010) and an unconfigured rule file (\SystemRoot\Alinubx.ccf) indicate the driver also carries dormant file/registry-hiding, process/driver interception, and network traffic-hijacking (local proxy) capabilities that were not activated in this deployment.

Once security tooling is disabled, Rapuncel installs as a Windows service for persistence, looping continuously to re-kill any restarted security product and re-run the stealer after reboot. It harvests stored credentials from more than 25 web browsers, using an injected browser-helper DLL (SHA256 75018b06...) that calls Chrome/Edge's own Elevation Service DecryptData method from inside the browser process to bypass app-bound encryption; steals files from 30+ cryptocurrency wallet applications; extracts Discord login tokens, Steam session tokens (via memory scanning after silently launching Steam), and Telegram session data; dumps Windows Credential Manager; harvests documents matching keywords like "password," "seed," "wallet," or "recovery"; and captures screenshots of all monitors. Stolen data is compressed into a ZIP archive and exfiltrated to a hardcoded C2 (2.26.126.50) via raw-TCP HTTP-formatted POST /upload requests, retried up to three times at two-second intervals. Sandbox analysis on two terminal redirect domains also showed consistent deletion of the Chrome extension-integrity registry key (HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings), a capability whose operational purpose Delphos could not fully determine.

Delphos assesses with moderate confidence that Rapuncel is a variant or sibling build within the BoryptGrab malware ecosystem, first documented by Trend Micro in March 2026 and later observed at much larger scale (292+ brand-impersonation repositories, ~78 redirector accounts) by Arctic Wolf in July 2026 using different loader (a signed WinGUP updater side-loading libcurl.dll) and C2 (193.143.1.131, Proton66/Russia) infrastructure. The two campaigns share a near-identical delivery architecture (SEO-optimized GitHub repos -> .github.io redirectors -> dynamically-routed payload servers -> oversized junk-padded ZIPs), overlapping collection artifacts, and the same distinctive Chrome/Edge Elevation Service app-bound-encryption bypass technique, but are not byte-identical and use different infrastructure and kernel-driver tooling — indicating either the same MaaS operator running parallel campaigns or multiple actors sharing a common toolkit. No named threat actor or nation-state attribution has been established. LastPass confirmed the campaign did not compromise LastPass's own systems, infrastructure, or customer vaults; it is a brand-impersonation lure only. Delphos reported the Alinubx.sys driver to Microsoft's MSRC Researcher Portal and the Windows Defender Security Intelligence driver portal on August 19, 2026.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1574.001 DLL

Execution

T1204.002 Malicious File

Credential Access

T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager

Persistence

T1543.003 Windows Service

Privilege Escalation

T1548.002 Bypass User Account Control

defense-impairment

T1553.002 Code Signing; T1685 Disable or Modify Tools

stealth

T1574.001 DLL

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Remediation for Rapuncel Alinubx EDR killer

Immediate actions

• Download LastPass Authenticator and any other security software only from official vendor domains (e.g., lastpass.com); never from GitHub search results or GitHub Pages mirrors
• Alert on execution of vsdbg.exe (or any renamed Visual Studio CoreCLR Debugger binary) from user-downloads or temp directories, especially when it loads a companion vsdbg.dll
• Hunt fleet-wide for the NvFsFilter service and for C:\Windows\System32\drivers\nvfsflt64.sys (SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61); treat any match as a confirmed compromise
• Block outbound network access to 2.26.126.50, albinofennel.com, hanselarinmusky.com, icansamyope.com, istatlmenus.com, macperformancetools.com, and zaffersnouty.com at DNS/perimeter
• Treat all browser passwords, crypto-wallet seed phrases, Discord/Steam/Telegram sessions, and Windows Credential Manager contents on any affected host as fully compromised; reset credentials from a known-clean device

Workarounds

• Restrict or closely monitor installation of third-party drivers signed only under the Windows Hardware Compatibility Publisher program via WDAC or Smart App Control policy
• Enable Microsoft Defender Application Control (or equivalent) to block unsigned or side-loaded DLLs adjacent to known debugger/developer-tool binaries

Longer-term hardening

• Deploy EDR/AV tamper protection that does not rely solely on Windows Protected Process Light — kernel-mode ObOpenObjectByPointer calls with AccessMode=KernelMode bypass PPL's user-mode SeAccessCheck path
• Submit Alinubx.sys (SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61) to your EDR vendor and to Microsoft's vulnerable/malicious driver blocklist process, since it is not yet present on the default Microsoft blocklist
• Implement WDAC/application-allowlisting rules that flag legitimately-signed drivers whose on-disk filename, service description, or OriginalFilename metadata diverge from their vendor's published product (renamed CcProtect.sys masquerading as an NVIDIA component)
• Monitor for DLL side-loading against known Microsoft developer/debugging tools launched from non-standard install paths

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows Server (any build enforcing WHCP driver signing)
• LastPass — LastPass Authenticator (brand impersonated only; LastPass systems, infrastructure, and customer vaults were not compromised)

Timeline of Rapuncel Alinubx EDR killer

• 2026-03-05 Trend Micro publishes the original locked-ioc-30 infostealer report, documenting distribution via 100+ SEO-optimized fake GitHub repositories since late 2025 — the malware family locked-ioc-31 is later assessed to be a variant of.
• 2026-06-26 A related, larger-scale BoryptGrab-lineage campaign begins, eventually creating 292+ brand-impersonation GitHub repositories and ~78 .github.io redirector accounts (documented separately by Arctic Wolf), sharing the same delivery architecture and Chrome/Edge app-bound-encryption bypass technique as locked-ioc-31.
• 2026-07-13 Arctic Wolf publishes analysis of the parallel BoryptGrab-lineage campaign impersonating Arctic Wolf and 290+ other brands, with high-confidence code-sharing to locked-ioc-30 but different C2 infrastructure (193.143.1.131, Proton66) than locked-ioc-31.
• 2026-08-13 LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team identifies a fraudulent GitHub organization (github.com/LastPass-Authenticator) impersonating LastPass Authenticator.
• 2026-08-19 Delphos Labs reports the Alinubx.sys malicious kernel driver to Microsoft's MSRC Researcher Portal and resubmits it to the Windows Defender Security Intelligence driver-submission portal.
• 2026-08-20 Alinubx.sys is checked against Microsoft's vulnerable-driver blocklist (DriverPolicy_Enforced.xml) and found absent; VirusTotal shows 0 of 72 engines detecting the driver as malicious.
• 2026-08-27 Researchers observe the locked-ioc-21/mandua.wonted dynamic-routing endpoint's content changing between August 27 and September 10, 2026, confirming the operators were actively maintaining the redirect infrastructure.
• 2026-09-10 LastPass/Delphos investigation snapshot date; the locked-ioc-21 redirect endpoint is confirmed live and still serving the JavaScript redirect chain.
• 2026-09-17 LastPass and Delphos Labs publish "One Kit, Forty Companies," the primary technical report documenting the locked-ioc-31 infostealer, the Alinubx.sys EDR-killer driver, and the underlying GitHub-based MaaS distribution kit.
• 2026-09-18 BleepingComputer and WindowsForum publish independent coverage corroborating the locked-ioc-31 campaign and its fake LastPass Authenticator GitHub lures.
• 2026-09-21 Cyber Security News publishes further coverage of the signed-driver AV/EDR-killing mechanism, prompting this threat's addition to the hunt backlog.

Sources cited for Rapuncel Alinubx EDR killer

• One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign blog.lastpass.com · Research · 2026-09-17
• Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer arcticwolf.com · Research · 2026-07-13
• Rapuncel Infostealer Killed 145 Security Tools Before Stealing Browser and Wallet Credentials techtimes.com · News · 2026-09-19
• Fake LastPass Authenticator Installs Signed AV-Killing Driver windowsforum.com · News · 2026-09-18
• Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer BleepingComputer · Article · 2026-09-18
• Signed Driver Disable Security Tools And Passwords cybersecuritynews.com · Article · 2026-09-21

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials Previous report
• Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns Next report