Security2 publishers2 min readPublished
Rapuncel ships a Microsoft-attested kernel driver built to terminate 145 security products
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
The Watch · Security desk
What happened
- LastPass found a fake LastPass Authenticator on GitHub on August 13 and tied it to a campaign that had been running for several months, with no compromise of its own systems.
- SEO put the fraudulent GitHub download page among the top results for people searching for the real application, and a second page offered a fake macOS version.
- The payload, Rapuncel, installs a kernel driver disguised as an NVIDIA graphics component and designed to terminate 145 antivirus and endpoint security products.
- With detection down, it collects saved passwords from 25 browsers, cryptocurrency files from 30 wallet applications, Discord, Steam and Telegram data, and the Windows credential store.
- Delivery ran through multiple GitHub pages into a Cloudflare-fronted server whose final destination the operator could repoint at will.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability An attested driver that kills 145 products makes endpoint detection something an attacker removes on arrival, so a quiet console on a suspect host is not evidence the host is clean.
- cost Cleanup moves out of the quarantine-the-sample workflow and into host rebuilds, and that bill lands on whoever owns the endpoint fleet rather than on the security team that found it.
- decision Letting users install software from GitHub-hosted release pages is now an admission-control decision, because search ranking was the distribution channel here.
- precedent The hiding and injection code shipped in the build but sat unconfigured, so that capability is already staged and a later iteration can enable it without new development.
The privilege escalation uses features already present in Windows [9], and the remedy LastPass describes is physical removal of the driver, not a patch. The company did not say how the operators obtained Microsoft attestation for that driver, or whether the signature has since been revoked [19].
LastPass said: "The malware installs itself as a Windows service that starts automatically every time the computer boots. It then loops continuously: checking for security products, killing any that have restarted, and re-running the stealer. The machine may remain fully under the attacker's control until the kernel driver is physically removed" [13]. The same driver carries code to hide itself and to inject a helper into every running process, and the build LastPass examined lacked the configuration to switch either on [10].
The executable inside the archive is Microsoft's own debugging tool under a different name, with the attacker's code sitting in the companion DLL it loads; the archive also holds a malicious file and junk [8]. Working with Delphos, LastPass tied that DLL to Cruciferra, a crypter service Proofpoint documented recently [14]. The DLL was probably built with a Cruciferra package called PUROSANGUE, which has produced other side-loaded DLLs containing EDR and AV kill code [15].
The Cloudflare-fronted server was still answering with a JavaScript redirect on September 10, 28 days after the August 13 discovery [6][18]. LastPass said "its content had changed between August 27 and September 10, confirming active ongoing maintenance" [7].
BoryptGrab, an infostealer pushed through roughly 100 GitHub repositories earlier this year, overlaps with this one at several points [16]. "Delphos compared the Rapuncel stealer payload directly against Trend Micro's documented BoryptGrab samples. The two families are not byte-identical; however, the behavioral and artifact-level overlap is strong. Delphos assesses Rapuncel is a BoryptGrab-related variant or sibling build," LastPass said [17].
What to watch
- Whether Microsoft revokes the attestation signature and the driver hash reaches Windows blocklists.
- Whether a later build ships with the hiding and process-injection features configured and active.
- Whether the Cloudflare-fronted server is repointed again after the September 10 observation, and whether the GitHub pages come down.