# Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos

> A malware-as-a-service operation impersonating LastPass Authenticator and 40+ other brands on SEO-optimized fake GitHub repositories delivers the previously undocumented Rapuncel infostealer alongside Alinubx.sys, a Microsoft Windows Hardware Compatibility Publisher-signed kernel driver disguised as an NVIDIA filesystem filter driver that kernel-terminates 145 hardcoded AV/EDR processes, bypassing Protected Process Light. The installer sideloads its payload via a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe), then Rapuncel harvests credentials from 25+ browsers (including Chrome/Edge app-bound encryption via injected-DLL bypass), 30+ cryptocurrency wallets, Discord/Steam/Telegram session data, and Windows Credential Manager contents.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2602
- **ID:** TL-2026-2602
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team, working with Delphos Labs, identified a malware-as-a-service (MaaS) distribution kit that impersonates at least 40 companies — including LastPass Authenticator — through fraudulent GitHub organizations (github.com/LastPass-Authenticator, github.com/LastPass-S) and GitHub Pages download portals (lastpass-authenticator.github.io) that rank in search results for terms like "LastPass Authenticator download." Victims are funneled through hidden GitHub Pages relay accounts (edgarcostartqd.github.io, dallikilic54.github.io) whose 404.html pages silently forward traffic through a Cloudflare-fronted redirect layer (istatlmenus.com), which dynamically supplies the current payload-server address at runtime via its /mandua.wonted endpoint — letting the operators rotate infrastructure without touching the lure pages. The final payload is served from one of several rotating domains (albinofennel.com, hanselarinmusky.com, icansamyope.com) as an intentionally bloated ZIP archive (up to 148MB, padded with junk files) designed to exceed the size limits of automated sandbox scanners.

Inside the archive, a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe) is used to side-load a malicious companion DLL (vsdbg.dll, SHA256 ea8c31a8...) built with a .NET NativeAOT runtime — a hardening choice that removes the easy IL-decompilation path defenders expect from Mono/.NET samples. Delphos assesses with high confidence that this loader was produced by the Cruciferra PUROSANGUE crypter package or a close derivative, based on matching .reloc-section payload storage, a custom Base16 encoding scheme, and an embedded build-path string (C:\ExploitTests\purosangue.tx).

The loader installs two components: the Rapuncel infostealer (SHA256 aefbc6e0...) and a kernel driver, Alinubx.sys (SHA256 611b3ba6...), dropped to disk as nvfsflt64.sys and registered as the "NvFsFilter" service, masquerading as an NVIDIA File System Filter Driver. The driver is in fact a renamed/repurposed build of CcProtect.sys v1.32, a legitimate host-defense driver from Henan Dafeng Software Co., Ltd.'s CnCrypt disk-encryption product — carrying a valid Microsoft Windows Hardware Compatibility Publisher signature chain (timestamped March 2023) and, as of the investigation, 0/72 VirusTotal detections and no entry on Microsoft's vulnerable-driver blocklist. The driver contains a hardcoded table of 145 antivirus/EDR process names and terminates them by calling ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time — defeating Protected Process Light (PPL) protections that many security products rely on to survive termination attempts by an administrator-level process. The driver exposes this kill function via IOCTL 0x222024 against device \\.\Alinubx; a second, unused IOCTL (0x222010) and an unconfigured rule file (\SystemRoot\Alinubx.ccf) indicate the driver also carries dormant file/registry-hiding, process/driver interception, and network traffic-hijacking (local proxy) capabilities that were not activated in this deployment.

Once security tooling is disabled, Rapuncel installs as a Windows service for persistence, looping continuously to re-kill any restarted security product and re-run the stealer after reboot. It harvests stored credentials from more than 25 web browsers, using an injected browser-helper DLL (SHA256 75018b06...) that calls Chrome/Edge's own Elevation Service DecryptData method from inside the browser process to bypass app-bound encryption; steals files from 30+ cryptocurrency wallet applications; extracts Discord login tokens, Steam session tokens (via memory scanning after silently launching Steam), and Telegram session data; dumps Windows Credential Manager; harvests documents matching keywords like "password," "seed," "wallet," or "recovery"; and captures screenshots of all monitors. Stolen data is compressed into a ZIP archive and exfiltrated to a hardcoded C2 (2.26.126.50) via raw-TCP HTTP-formatted POST /upload requests, retried up to three times at two-second intervals. Sandbox analysis on two terminal redirect domains also showed consistent deletion of the Chrome extension-integrity registry key (HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings), a capability whose operational purpose Delphos could not fully determine.

Delphos assesses with moderate confidence that Rapuncel is a variant or sibling build within the BoryptGrab malware ecosystem, first documented by Trend Micro in March 2026 and later observed at much larger scale (292+ brand-impersonation repositories, ~78 redirector accounts) by Arctic Wolf in July 2026 using different loader (a signed WinGUP updater side-loading libcurl.dll) and C2 (193.143.1.131, Proton66/Russia) infrastructure. The two campaigns share a near-identical delivery architecture (SEO-optimized GitHub repos -> .github.io redirectors -> dynamically-routed payload servers -> oversized junk-padded ZIPs), overlapping collection artifacts, and the same distinctive Chrome/Edge Elevation Service app-bound-encryption bypass technique, but are not byte-identical and use different infrastructure and kernel-driver tooling — indicating either the same MaaS operator running parallel campaigns or multiple actors sharing a common toolkit. No named threat actor or nation-state attribution has been established. LastPass confirmed the campaign did not compromise LastPass's own systems, infrastructure, or customer vaults; it is a brand-impersonation lure only. Delphos reported the Alinubx.sys driver to Microsoft's MSRC Researcher Portal and the Windows Defender Security Intelligence driver portal on August 19, 2026.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1204.002 Malicious File
- T1574.001 DLL
- T1543.003 Windows Service
- T1548.002 Bypass User Account Control
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1528 Steal Application Access Token
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data

## Sources

- [Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer](https://www.bleepingcomputer.com/news/security/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infostealer/)
- [Signed Driver Disable Security Tools And Passwords](https://cybersecuritynews.com/signed-driver-disable-security-tools-and-passwords/)
- [One Kit, Forty Companies: How a Malware-as-a-Service Platform Used GitHub as a Distribution Network for its Campaign](https://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealer)
- [Malicious GitHub Campaign: Fake "Arctic Wolf" and 290+ Brand-Impersonation Repositories Deliver BoryptGrab-Lineage Infostealer](https://arcticwolf.com/resources/blog/fake-github-repositories-deliver-boryptgrab-lineage-infostealer/)
- [Rapuncel Infostealer Killed 145 Security Tools Before Stealing Browser and Wallet Credentials](https://www.techtimes.com/articles/327744/20260919/rapuncel-infostealer-killed-145-security-tools-before-stealing-browser-wallet-credentials.htm)
- [Fake LastPass Authenticator Installs Signed AV-Killing Driver](https://windowsforum.com/news/fake-lastpass-authenticator-installs-signed-av-killing-driver.444969/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2602