Security1 publisher2 min readPublished
A Microsoft-signed driver in fake LastPass GitHub repos kills 145 security products
LastPass and Delphos Labs traced SEO-tuned GitHub repositories impersonating at least 40 software brands to a new stealer called Rapuncel, shipped alongside a signed kernel driver that opens protected security processes as kernel code and terminates them.
The Watch · Security desk
What happened
- LastPass and Delphos Labs found search-optimized GitHub repositories impersonating the LastPass brand and at least 39 other software companies to distribute a previously undocumented infostealer called Rapuncel.
- Victims searching for LastPass Authenticator reach the fake repos, and the download buttons chain through redirections to payload servers that hand back ZIP archives padded to as much as 148MB to evade scanning.
- Inside the archive is a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger, vsdbg.exe, set up to sideload a malicious vsdbg.dll that drops both the stealer and the Alinubx.sys kernel driver.
- That driver, signed through Microsoft's Windows Hardware Compatibility Publisher chain, carries a hardcoded list of 145 antivirus and EDR processes it tries to terminate.
- Rapuncel then takes credentials from 25 web browsers, data from 30 cryptocurrency wallets, and Discord, Steam and Telegram session credentials.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The endpoint agent is the first thing hit. Collection only starts after the security software is dead, so the host is blind for the entire theft window.
- constraint This sample loads straight past driver blocklist policy. Until Microsoft lists the hash or revokes the certificate, stopping the load depends on allow-listing what may enter the kernel.
- decision Where engineers install tools from search results, software sourcing becomes an endpoint control. The delivery step here is a GitHub page ranked by SEO. That route runs clear of mail filtering and phishing training.
- capability Whoever holds this signed driver has more than an AV killer available: registry and file hiding, DLL injection, traffic manipulation and port redirection sit in the code unused, ready for a later campaign.
The kill works without asking user mode for permission. The driver "calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time," LastPass said [7]. "It asks the kernel to open the process as kernel code, then kills it. That is why it can defeat Protected Process Light (PPL); the protection many security products rely on to survive an administrator," the company said [8].
Alinubx.sys is unlisted in Microsoft's vulnerable drivers blocklist [9]. It also loads as an NVIDIA filter, registering the NvFsFilter service under the filename nvfsflt64.sys [5]. Both of the controls that usually stop a signed-driver abuse chain miss this one [11].
Ordering matters after that. Rapuncel persists through a Windows service, and any security tool that reactivates gets killed again before the stealer launches, so restarting an agent does not restore visibility on that host [12].
Collection starts once the security software is down [23]. The stealer takes the contents of Windows Credential Manager, screenshots from every connected monitor, and documents whose filenames contain "password," "seed," "wallet," or "recovery" [13]. On Chrome, Edge and related browsers it gets past app-bound encryption by injecting a helper DLL into the browser and invoking the browser's own Elevation Service [14]. The compressed archive goes to 2.26.126[.]50 as an HTTP-formatted request sent over raw TCP [15].
Neither half of this is bespoke. LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of BoryptGrab [16], and found its loader built with the Cruciferra PUROSANGUE crypter [17]. The lure side is production work as well: counting LastPass plus the 39 other impersonated companies, the repository set covers at least 40 brands [18].
The researchers describe the campaign as ongoing and did not disclose a victim count or a start date [22]. Their advice to users is to download software only from official websites, avoid dubious GitHub repositories, and skip or block promoted results on Google Search [19].
What to watch
- Whether Microsoft adds Alinubx.sys to the vulnerable drivers blocklist and revokes the Windows Hardware Compatibility Publisher signature on the sample.
- Whether GitHub removes the impersonating repository set, and whether it returns under a fresh list of brands.
- Whether Alinubx.sys turns up in campaigns unconnected to this repository set or this stealer.