A Microsoft-signed driver in a fake GitHub download kills 145 security process names from kernel mode

Alinubx.sys lands as `nvfsflt64.sys` in `C:\Windows\System32\drivers`, registered behind a service named `NvFsFilter` ^[12]. The driver carries a Microsoft compatibility signature ^[7]. The analysis from LastPass TIME and Delphos Labs, published 17 September, states the precondition for that step: driver deployment and service registration are permitted, and are not blocked by application control or driver blocks ^[1][10]. The signature satisfies the load policy, and application control or a driver block list decides the load.

The same report names four attributes to block: the hash, the signature family, the device name, and the service creation ^[11], and three of those you can write into configuration before you have a sample.

Getting to that point takes one download by one person. A user searches for legitimate software and follows SEO-optimised links to a fake repository, part of infrastructure impersonating more than 40 companies ^[2][3]. The page also displays a VirusTotal approval, which is part of the page ^[13]. The ZIP is padded to between 127 and 148 MB and served through GitHub Pages 404 handling and dynamic redirects behind Cloudflare ^[4]. Inside, a fake installer loads a malicious `vsdbg.dll` into the legitimate `vsdbg.exe` and reaches SYSTEM through multiple UAC elevation techniques ^[5].

From kernel mode the driver then terminates processes matching 145 built-in AV and EDR-related process names ^[6]. The 145 is a count of names compiled into someone else's driver, so the question for a given fleet is whether its product's process names are among them. The report's endpoint guidance is instructive about timing: watch for `vsdbg.exe` loading an unexpected DLL, DLL side-loading, driver deployment, creation of the `NvFsFilter` service, and termination requests aimed at numerous security processes ^[21]. Every one of those except the last sits before the kill.

Then the theft. Saved credentials are decrypted by bypassing browser App-Bound Encryption ^[14], and Rapuncel collects from browsers, cryptocurrency wallets, Discord, Steam, Telegram and Windows Credential Manager before sending to 2.26.126[.]50 as HTTP format over raw TCP ^[8][17]. A Windows service keeps both halves running after reboot, the process killing and the collection ^[9]. Stolen browser, Discord, Steam and Telegram sessions then show up as identity provider activity ^[19].

On scope, the two firms say they analysed acquired samples and confirmed the operation of Rapuncel, Alinubx.sys and the browser injection DLLs; the number of affected endpoints has not been publicly disclosed ^[16]. Access to the fake organisations and pages cannot be confirmed from internal GitHub audit logs, so the report falls back to proxy, secure web gateway or browser history ^[15].

No email distribution was observed ^[20]. I would act on that, because it moves the control out of mail filtering and into two places most shops treat as lower priority: what drivers a machine is allowed to load, and where software comes from. The report's own containment line is to restrict software distribution to official websites and managed stores, and not to execute unofficial distributions on GitHub ^[18].