Fake GitHub Downloads Pair Rapuncel Credential Theft With a Signed EDR-Killing Driver

Search results lead users into a counterfeit software ecosystem

An ongoing malware campaign is using search-optimized GitHub repositories to impersonate LastPass and at least 39 other software companies. Users searching for LastPass Authenticator or other popular applications can encounter repositories designed to resemble legitimate download pages.

LastPass and Delphos Labs disclosed the campaign on September 18, 2026. The operation distributes a previously undocumented information stealer called Rapuncel, supported by a Microsoft-signed kernel driver that can terminate security software.

The attack begins with social engineering rather than exploitation of a vulnerability in LastPass Authenticator. Victims select a download from a fraudulent repository, after which several redirects take them to infrastructure hosting a malicious ZIP archive.

Those archives may be inflated to as much as 148 MB. The unusual size is intended to interfere with automated systems that skip, limit, or incompletely inspect large files and compressed packages.

The campaign’s scope extends beyond a single brand. By creating repositories around many recognizable products, the operators can target users at the moment they are actively seeking software and are prepared to execute an installer.

A legitimate Microsoft debugger becomes the loader

Inside the archive, the attackers use a legitimate Microsoft binary to conceal the start of the infection chain. The executable is a copy of the Microsoft Visual Studio CoreCLR Debugger, identified as vsdbg.exe.

Rather than directly embedding all malicious behavior in that executable, the package places a hostile library named vsdbg.dll where the debugger will load it. This DLL sideloading technique abuses a trusted application’s library-loading behavior, allowing malicious code to run in the context of a legitimate Microsoft program.

Execution installs two principal components:

• The Rapuncel information stealer.
• The Alinubx.sys kernel driver used to disable defenses.

The driver is also presented as an NVIDIA component under the filename nvfsflt64.sys. On the infected Windows system, it registers a service named NvFsFilter, giving defenders several related artifacts to monitor.

No affected software versions are applicable because this is not a disclosed product vulnerability with a patchable version range. The attack depends on convincing a user to download and run a counterfeit package.

The signed driver can terminate 145 security products

The driver contains a hardcoded list covering 145 antivirus and endpoint detection and response processes. Its role is to neutralize those products before Rapuncel begins collecting valuable data.

This capability operates below normal user-mode controls. Alinubx.sys invokes ObOpenObjectByPointer with AccessMode=KernelMode, obtaining process access without following the ordinary user-mode SeAccessCheck path used when handles are created.

That distinction lets the driver interfere with processes that would otherwise resist termination, including products using Protected Process Light (PPL). PPL is intended to prevent even administrator-level processes from freely manipulating protected security services. A cooperating kernel driver can bypass that boundary.

The driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain. It is not currently included in Microsoft’s vulnerable-driver blocklist, according to the disclosed findings. Consequently, defenders cannot assume Windows will reject it solely because of its driver status or signature.

Researchers also found code associated with additional functions:

• Hiding files and registry content.
• Injecting DLLs.
• Intercepting drivers and processes.
• Manipulating network traffic.
• Redirecting ports.

These capabilities were dormant or unused in the observed campaign. They show what the driver may support, but they should not be treated as confirmed actions on every compromised machine.

Rapuncel targets browsers, wallets, sessions, and recovery material

Once security products have been stopped, Rapuncel performs broad credential and data collection. It targets stored credentials from 25 web browsers and information associated with 30 cryptocurrency wallets.

The stealer also seeks session credentials for Discord, Steam, and Telegram, as well as secrets stored in Windows Credential Manager. A stolen session may allow an attacker to enter an account without immediately needing to reproduce the victim’s normal authentication process.

Rapuncel searches for documents whose filenames contain the terms password, seed, wallet, or recovery. This targeting creates a direct risk to password lists, cryptocurrency seed phrases, wallet-recovery instructions, and other sensitive records.

The malware captures screenshots from every connected monitor and inventories the infected system. Multiple displays therefore expand the amount of potentially exposed information, including applications or documents left visible outside the primary screen.

For Chromium-based browsers, the malware includes a method intended to overcome Google’s app-bound encryption protections. It injects a helper DLL into the browser application and invokes the browser’s own Elevation Service, rather than relying only on direct access to encrypted credential files.

Stolen information is compressed and transmitted to 2.26.126[.]50. The traffic uses an HTTP-formatted request carried over raw TCP.

Rapuncel also creates a Windows service for persistence. If a security product restarts after the initial compromise, the malware attempts to terminate it again before relaunching the stealer. This turns defense evasion into a continuing part of the infection rather than a one-time action.

Researchers connect Rapuncel to an existing malware lineage

LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of BoryptGrab. They also attributed production of the loader to the Cruciferra PUROSANGUE crypter.

The campaign combines several techniques that reinforce one another. Search manipulation and brand impersonation bring the victim to the payload, while GitHub provides a familiar-looking setting for the fraudulent download.

DLL sideloading then places malicious execution behind a legitimate Microsoft debugger. The signed kernel driver suppresses endpoint visibility, and Rapuncel collects credentials, wallet information, documents, screenshots, and system data while maintaining persistence.

The signing chain raises the severity of the intrusion, but it does not make the package trustworthy. Code signing can confirm that a driver passed through a signing process; it does not guarantee that the driver’s current behavior is safe.

Defenders should hunt across download, driver, and network activity

Users should obtain LastPass Authenticator and other applications directly from the relevant vendor’s official website. A GitHub repository should not be trusted merely because it carries familiar branding, polished instructions, or a download button resembling an official page.

Organizations can also consider blocking promoted search results when they direct users to unofficial software-download locations. Search results should be treated as discovery mechanisms, not as proof that a repository belongs to the named vendor.

Security teams should investigate the following host indicators and behaviors:

• vsdbg.exe loading a nearby or unexpected vsdbg.dll.
• Creation of the NvFsFilter Windows service.
• Presence of Alinubx.sys or nvfsflt64.sys.
• Unexplained termination of antivirus or EDR processes.
• DLL injection into browser processes.
• Newly created Windows services associated with unfamiliar binaries.
• Access to documents containing password, seed, wallet, or recovery in their filenames.
• Outbound connections to 2.26.126[.]50.
• HTTP-like data sent over raw TCP to unusual destinations.

Incident responders should not rely exclusively on endpoint alerts because the driver’s purpose is to suppress those controls. Network telemetry, Windows service creation records, driver-loading events, browser injection evidence, and centralized logs may preserve activity that the affected endpoint can no longer report.

There is no campaign-specific patch identified for users to install. The immediate defenses are trusted-source software acquisition, blocking known infrastructure, detecting the listed artifacts, and isolating systems that show evidence of driver installation or credential collection.