Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos

Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill (TL-2026-2602), also tracked as Rapuncel Stealer, is a high-severity malware campaign, first published 2026-09-21. It has no confirmed attribution, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1005, T1036.005, T1055), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-2602

Threat ID
TL-2026-2602
Also known as
Rapuncel Stealer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-21
Last reviewed
2026-09-21
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
all sectors opportunistic consumer enterprise windows users, software supply chain, cryptocurrency
Target regions
Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

Malware and tooling: BoryptGrab, Rapuncel

A malware-as-a-service operation impersonating LastPass Authenticator and 40+ other brands on SEO-optimized fake GitHub repositories delivers the previously undocumented Rapuncel infostealer alongside Alinubx.sys, a Microsoft Windows Hardware Compatibility Publisher-signed kernel driver disguised as an NVIDIA filesystem filter driver that kernel-terminates 145 hardcoded AV/EDR processes, bypassing Protected Process Light. The installer sideloads its payload via a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe), then Rapuncel harvests credentials from 25+ browsers (including Chrome/Edge app-bound encryption via injected-DLL bypass), 30+ cryptocurrency wallets, Discord/Steam/Telegram session data, and Windows Credential Manager contents.

How Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill works

LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team, working with Delphos Labs, identified a malware-as-a-service (MaaS) distribution kit that impersonates at least 40 companies — including LastPass Authenticator — through fraudulent GitHub organizations (github.com/LastPass-Authenticator, github.com/LastPass-S) and GitHub Pages download portals (lastpass-authenticator.github.io) that rank in search results for terms like "LastPass Authenticator download." Victims are funneled through hidden GitHub Pages relay accounts (edgarcostartqd.github.io, dallikilic54.github.io) whose 404.html pages silently forward traffic through a Cloudflare-fronted redirect layer (istatlmenus.com), which dynamically supplies the current payload-server address at runtime via its /mandua.wonted endpoint — letting the operators rotate infrastructure without touching the lure pages. The final payload is served from one of several rotating domains (albinofennel.com, hanselarinmusky.com, icansamyope.com) as an intentionally bloated ZIP archive (up to 148MB, padded with junk files) designed to exceed the size limits of automated sandbox scanners.

Inside the archive, a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe) is used to side-load a malicious companion DLL (vsdbg.dll, SHA256 ea8c31a8...) built with a .NET NativeAOT runtime — a hardening choice that removes the easy IL-decompilation path defenders expect from Mono/.NET samples. Delphos assesses with high confidence that this loader was produced by the Cruciferra PUROSANGUE crypter package or a close derivative, based on matching .reloc-section payload storage, a custom Base16 encoding scheme, and an embedded build-path string (C:\ExploitTests\purosangue.tx).

The loader installs two components: the Rapuncel infostealer (SHA256 aefbc6e0...) and a kernel driver, Alinubx.sys (SHA256 611b3ba6...), dropped to disk as nvfsflt64.sys and registered as the "NvFsFilter" service, masquerading as an NVIDIA File System Filter Driver. The driver is in fact a renamed/repurposed build of CcProtect.sys v1.32, a legitimate host-defense driver from Henan Dafeng Software Co., Ltd.'s CnCrypt disk-encryption product — carrying a valid Microsoft Windows Hardware Compatibility Publisher signature chain (timestamped March 2023) and, as of the investigation, 0/72 VirusTotal detections and no entry on Microsoft's vulnerable-driver blocklist. The driver contains a hardcoded table of 145 antivirus/EDR process names and terminates them by calling ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time — defeating Protected Process Light (PPL) protections that many security products rely on to survive termination attempts by an administrator-level process. The driver exposes this kill function via IOCTL 0x222024 against device \\.\Alinubx; a second, unused IOCTL (0x222010) and an unconfigured rule file (\SystemRoot\Alinubx.ccf) indicate the driver also carries dormant file/registry-hiding, process/driver interception, and network traffic-hijacking (local proxy) capabilities that were not activated in this deployment.

Once security tooling is disabled, Rapuncel installs as a Windows service for persistence, looping continuously to re-kill any restarted security product and re-run the stealer after reboot. It harvests stored credentials from more than 25 web browsers, using an injected browser-helper DLL (SHA256 75018b06...) that calls Chrome/Edge's own Elevation Service DecryptData method from inside the browser process to bypass app-bound encryption; steals files from 30+ cryptocurrency wallet applications; extracts Discord login tokens, Steam session tokens (via memory scanning after silently launching Steam), and Telegram session data; dumps Windows Credential Manager; harvests documents matching keywords like "password," "seed," "wallet," or "recovery"; and captures screenshots of all monitors. Stolen data is compressed into a ZIP archive and exfiltrated to a hardcoded C2 (2.26.126.50) via raw-TCP HTTP-formatted POST /upload requests, retried up to three times at two-second intervals. Sandbox analysis on two terminal redirect domains also showed consistent deletion of the Chrome extension-integrity registry key (HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings), a capability whose operational purpose Delphos could not fully determine.

Delphos assesses with moderate confidence that Rapuncel is a variant or sibling build within the BoryptGrab malware ecosystem, first documented by Trend Micro in March 2026 and later observed at much larger scale (292+ brand-impersonation repositories, ~78 redirector accounts) by Arctic Wolf in July 2026 using different loader (a signed WinGUP updater side-loading libcurl.dll) and C2 (193.143.1.131, Proton66/Russia) infrastructure. The two campaigns share a near-identical delivery architecture (SEO-optimized GitHub repos -> .github.io redirectors -> dynamically-routed payload servers -> oversized junk-padded ZIPs), overlapping collection artifacts, and the same distinctive Chrome/Edge Elevation Service app-bound-encryption bypass technique, but are not byte-identical and use different infrastructure and kernel-driver tooling — indicating either the same MaaS operator running parallel campaigns or multiple actors sharing a common toolkit. No named threat actor or nation-state attribution has been established. LastPass confirmed the campaign did not compromise LastPass's own systems, infrastructure, or customer vaults; it is a brand-impersonation lure only. Delphos reported the Alinubx.sys driver to Microsoft's MSRC Researcher Portal and the Windows Defender Security Intelligence driver portal on August 19, 2026.

MITRE ATT&CK techniques used in TL-2026-2602

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1574.001 DLL

Execution

T1204.002 Malicious File

Credential Access

T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers; T1555.004 Windows Credential Manager

Persistence

T1543.003 Windows Service

Privilege Escalation

T1548.002 Bypass User Account Control

defense-impairment

T1553.002 Code Signing; T1685 Disable or Modify Tools

stealth

T1574.001 DLL

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Affected products and versions in Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server (any build enforcing WHCP driver signing)
  • LastPass — LastPass Authenticator (brand impersonated only; LastPass systems, infrastructure, and customer vaults were not compromised)

Remediation for Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

Immediate actions

  • Download LastPass Authenticator and any other security software only from official vendor domains (e.g., lastpass.com); never from GitHub search results or GitHub Pages mirrors
  • Alert on execution of vsdbg.exe (or any renamed Visual Studio CoreCLR Debugger binary) from user-downloads or temp directories, especially when it loads a companion vsdbg.dll
  • Hunt fleet-wide for the NvFsFilter service and for C:\Windows\System32\drivers\nvfsflt64.sys (SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61); treat any match as a confirmed compromise
  • Block outbound network access to 2.26.126.50, albinofennel.com, hanselarinmusky.com, icansamyope.com, istatlmenus.com, macperformancetools.com, and zaffersnouty.com at DNS/perimeter
  • Treat all browser passwords, crypto-wallet seed phrases, Discord/Steam/Telegram sessions, and Windows Credential Manager contents on any affected host as fully compromised; reset credentials from a known-clean device

Workarounds

  • Restrict or closely monitor installation of third-party drivers signed only under the Windows Hardware Compatibility Publisher program via WDAC or Smart App Control policy
  • Enable Microsoft Defender Application Control (or equivalent) to block unsigned or side-loaded DLLs adjacent to known debugger/developer-tool binaries

Longer-term hardening

  • Deploy EDR/AV tamper protection that does not rely solely on Windows Protected Process Light — kernel-mode ObOpenObjectByPointer calls with AccessMode=KernelMode bypass PPL's user-mode SeAccessCheck path
  • Submit Alinubx.sys (SHA256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61) to your EDR vendor and to Microsoft's vulnerable/malicious driver blocklist process, since it is not yet present on the default Microsoft blocklist
  • Implement WDAC/application-allowlisting rules that flag legitimately-signed drivers whose on-disk filename, service description, or OriginalFilename metadata diverge from their vendor's published product (renamed CcProtect.sys masquerading as an NVIDIA component)
  • Monitor for DLL side-loading against known Microsoft developer/debugging tools launched from non-standard install paths

Weaknesses (CWE) in Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

CWE-494, CWE-706, CWE-829

Timeline of Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

  • Trend Micro publishes the original BoryptGrab infostealer report, documenting distribution via 100+ SEO-optimized fake GitHub repositories since late 2025 — the malware family Rapuncel is later assessed to be a variant of.
  • A related, larger-scale BoryptGrab-lineage campaign begins, eventually creating 292+ brand-impersonation GitHub repositories and ~78 .github.io redirector accounts (documented separately by Arctic Wolf), sharing the same delivery architecture and Chrome/Edge app-bound-encryption bypass technique as Rapuncel.
  • Arctic Wolf publishes analysis of the parallel BoryptGrab-lineage campaign impersonating Arctic Wolf and 290+ other brands, with high-confidence code-sharing to BoryptGrab but different C2 infrastructure (193.143.1.131, Proton66) than Rapuncel.
  • LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team identifies a fraudulent GitHub organization (github.com/LastPass-Authenticator) impersonating LastPass Authenticator.
  • Delphos Labs reports the Alinubx.sys malicious kernel driver to Microsoft's MSRC Researcher Portal and resubmits it to the Windows Defender Security Intelligence driver-submission portal.
  • Alinubx.sys is checked against Microsoft's vulnerable-driver blocklist (DriverPolicy_Enforced.xml) and found absent; VirusTotal shows 0 of 72 engines detecting the driver as malicious.
  • Researchers observe the istatlmenus.com/mandua.wonted dynamic-routing endpoint's content changing between August 27 and September 10, 2026, confirming the operators were actively maintaining the redirect infrastructure.
  • LastPass/Delphos investigation snapshot date; the istatlmenus.com redirect endpoint is confirmed live and still serving the JavaScript redirect chain.
  • LastPass and Delphos Labs publish "One Kit, Forty Companies," the primary technical report documenting the Rapuncel infostealer, the Alinubx.sys EDR-killer driver, and the underlying GitHub-based MaaS distribution kit.
  • BleepingComputer and WindowsForum publish independent coverage corroborating the Rapuncel campaign and its fake LastPass Authenticator GitHub lures.
  • Cyber Security News publishes further coverage of the signed-driver AV/EDR-killing mechanism, prompting this threat's addition to the hunt backlog.

Sources cited for Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill

More in malware

Detection coverage for TL-2026-2602

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2602 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats