Researchers at LastPass and Delphos Labs have identified a malware operation that leverages search-optimized GitHub repositories to masquerade as legitimate software makers, distributing a previously unknown information stealer named Rapuncel. The campaign targets the LastPass brand alongside at least 39 other companies, combining the infostealer with a Microsoft-signed kernel driver capable of neutralizing 145 antivirus and endpoint detection and response (EDR) solutions.
The infection sequence starts when users search for LastPass Authenticator or similar applications and click through to counterfeit GitHub pages. From there, download buttons redirect victims through multiple hops before landing on payload servers that deliver ZIP files artificially inflated to 148MB in size to circumvent security scanning.
Inside these archives sits a repackaged version of the legitimate Microsoft Visual Studio CoreCLR Debugger, vsdbg.exe, which has been renamed and configured to load a malicious DLL called vsdbg.dll. This setup deploys both the Rapuncel infostealer and the Alinubx.sys kernel driver, the latter engineered to terminate security software.
The kernel driver masquerades as an NVIDIA component under the name nvfsflt64.sys and registers itself as the NvFsFilter service. It functions as an EDR killer with an embedded list of 145 antivirus and EDR processes targeted for termination.
LastPass explained the driver's evasion technique: "The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time. It asks the kernel to open the process as kernel code, then kills it. That is why it can defeat Protected Process Light (PPL); the protection many security products rely on to survive an administrator."
The driver currently does not appear on Microsoft's vulnerable drivers blocklist, and the variant deployed in this campaign carries a valid signature through Microsoft's Windows Hardware Compatibility Publisher chain. Researchers noted that Alinubx.sys possesses additional dormant features for file and registry concealment, DLL injection, driver and process interception, traffic manipulation, and port redirection, though these capabilities remain inactive in the current campaign.
Rapuncel's data harvesting capabilities
Once security defenses are disabled, Rapuncel begins extracting sensitive information from the compromised system. The infostealer targets a broad range of data sources across the device.
- Credentials from 25 web browsers
- Data held in 30 cryptocurrency wallets
- Session tokens for Discord, Steam, and Telegram
- Windows Credential Manager stored credentials
- Files with names containing "password," "seed," "wallet," or "recovery"
- Screenshots captured from all connected monitors
- Complete system configuration details
To circumvent Google's app-bound encryption in Chrome, Edge, and similar browsers, Rapuncel injects a helper DLL into the browser process and calls its own Elevation Service. Collected data gets compressed and transmitted to an external server at 2.26.126[.]50 via HTTP requests sent over raw TCP connections.
The infostealer maintains persistence through a Windows service, ensuring that any reactivated security tools are terminated again before Rapuncel executes.
Researchers assessed with moderate confidence that Rapuncel represents a variant of BoryptGrab. They also determined that its loader was constructed using the Cruciferra PUROSANGUE crypter.
Mitigation recommendations
- Download software exclusively from official vendor websites
- Avoid repositories on GitHub that appear suspicious or unfamiliar
- Disable or filter promoted search results in Google Search