Author: DigitalSpying Security Desk
Date: September 18, 2026
Executive Summary
In a sophisticated malware distribution campaign combining developer-platform SEO poisoning with high-level kernel evasion, threat actors have been observed distributing a newly uncovered information stealer designated Rapuncel. As exposed in joint threat research by LastPass and Delphos Labs, and reported by BleepingComputer and The 420, the campaign utilizes coordinated clusters of fraudulent GitHub repositories impersonating the official desktop releases of LastPass Authenticator and over 40 other popular enterprise security and productivity brands.
While the primary payload—Rapuncel—is engineered to exfiltrate web browser credentials, Discord/Telegram session tokens, cryptocurrency seed phrases, and desktop screenshots, the campaign’s true technical menace lies in its auxiliary payload: a Bring Your Own Vulnerable Driver (BYOVD) attack. Alongside the stealer, the infection chain deploys Alinubx.sys, a Windows kernel driver disguised as legitimate NVIDIA hardware components. Despite its malicious functionality, the driver bears an authentic, valid Microsoft Windows Hardware Compatibility Publisher digital signature. Operating with kernel-level ring 0 authority, the driver systematically terminates and neutralizes 145 distinct Antivirus, Endpoint Detection and Response (EDR), and XDR security processes, completely blinding host security defenses before the stealer begins its collection phase.
Deep-Dive Technical Analysis
1. Delivery & SEO Poisoning via Fake GitHub Repositories
The operators behind Rapuncel bypass traditional email spam filtering by exploiting the inherent search engine trust and developer reputation of GitHub:
* Brand Hijacking: Adversaries establish dozens of GitHub repositories featuring polished README documentation, authentic logos, fake star counts, and automated commit histories impersonating LastPass Authenticator, KeePass, Bitwarden, AnyDesk, and Proton VPN.
* Search Engine Manipulation (SEO Poisoning): When users search for desktop authenticator utilities or installers, search engines prioritize the GitHub repository pages.
* The Delivery Archive: Users download release archives (LastPass_Authenticator_Installer.zip) containing what appears to be a legitimate multi-file application suite.
2. Multi-Stage Ingestion: DLL Sideloading via Microsoft CoreCLR Debugger
To evade on-disk execution heuristics, the infection chain utilizes Living-off-the-Land (LotL) execution:
* Abusing vsdbg.exe: The archive bundles a legitimate, signed copy of the Microsoft Visual Studio CoreCLR Debugger executable (vsdbg.exe).
* DLL Sideloading Execution: When executed, vsdbg.exe automatically looks for dependent support libraries in its current working directory without enforcing strict path resolution. The attackers plant a trojanized DLL which the trusted Microsoft debugger immediately executes within its trusted process memory space.
* Staged Extraction: The sideloaded DLL unpacks two embedded components into temporary directories: the user-mode stealer (Rapuncel) and the kernel-mode driver (Alinubx.sys).
3. The BYOVD Kernel Attack: Abusing Alinubx.sys
The standout technical capability of the campaign is the deployment of Alinubx.sys:
* The Digital Signature Advantage: In modern 64-bit Windows environments, Driver Signature Enforcement (DSE) strictly prevents the loading of unsigned kernel drivers. Attackers circumvent this control using Bring Your Own Vulnerable Driver (BYOVD): they obtain a driver that was legitimately signed by Microsoft through the Windows Hardware Quality Labs (WHQL) program or through compromised developer signing certificates.
* The "EDR Killer" Process Loop: Once loaded into the kernel via the Windows Service Control Manager (sc.exe create), Alinubx.sys operates in Ring 0. It iterates through active processes, comparing process names and hashes against an embedded list of 145 security solutions.
* Neutralizing Protected Processes: Under normal conditions, Windows protects antivirus and EDR processes using Protected Process Light (PPL) technology, which prevents standard administrator accounts from terminating them. Operating from the kernel, Alinubx.sys unhooks PPL protections or directly invokes kernel process termination primitives (ZwTerminateProcess), killing defensive agents without triggering access-denied errors.
4. Rapuncel Information Stealing Capabilities
With endpoint detection agents completely terminated, the Rapuncel stealer executes unhindered:
* Browser Harvesting: Targets Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and Firefox, extracting stored credentials, autofill forms, credit card tokens, and SQLite session cookies.
* Cryptocurrency Scraping: Searches for extension storage associated with popular Web3 wallets (MetaMask, Phantom, Coinbase Wallet) and conducts automated recursive file searches across the file system for files matching patterns such as *wallet*, *seed*, *recovery*, or *secret*.txt.
* Session Hijacking: Copies raw SQLite database files and session tokens for Telegram Desktop, Discord, and gaming platforms (Steam).
Threat & Evasion Matrix
Dimension / Parameter
Operational Mechanism
Defensive Impact
Initial Delivery
SEO-Poisoned GitHub Repositories
Inherits high search engine domain trust; Bypasses email security
Execution Vector
DLL Sideloading via Microsoft vsdbg.exe
Executes inside legitimate Microsoft process context
Defense Evasion
BYOVD Kernel Driver (Alinubx.sys)
Abuses Microsoft WHQL signature to enter Ring 0
Antivirus Termination
Hardcoded process-killing loop
Disables 145 enterprise Antivirus, EDR, and XDR agents
Target Data
Passwords, Crypto Seeds, Browser Sessions
Comprehensive identity and financial asset theft
Industry Impact: The Escalating Crisis of BYOVD Attacks
* The Trust Deficit in Driver Signing: The campaign demonstrates that digital signatures—even those originating from Microsoft Hardware Compatibility publishers—no longer guarantee software safety. Threat actors actively hoard vulnerable or malicious signed drivers to bypass Windows kernel security.
* Brand Abuse on Open Developer Platforms: The impersonation of over 40 distinct security brands on GitHub underscores the aggressive weaponization of public code-sharing platforms as malware distribution hubs. LastPass confirmed that its own infrastructure, cloud services, and customer vaults remained completely uncompromised; the attackers merely capitalized on the LastPass name to mislead consumers.
Actionable Mitigation & Defensive Recommendations
1. Enforce Microsoft Vulnerable Driver Blocklists
Organizations must enforce kernel driver protections to prevent vulnerable or abusive drivers from loading:
* Enable Hypervisor-Protected Code Integrity (HVCI): Turn on Memory Integrity / HVCI in Windows Security (Device Security > Core Isolation).
* Deploy Microsoft Recommended Driver Blocklist: Ensure the Windows Defender Application Control (WDAC) vulnerable driver blocklist is enabled via Group Policy or Intune, which actively prevents known abusive drivers like Alinubx.sys from registering in the kernel.
2. Hunting for Sideloading & Driver Registration
Security operations centers (SOCs) should deploy behavioral hunting rules:
* Monitor Unfamiliar Service Creation: Alert on new Windows services created with .sys binary paths located in %TEMP%, %APPDATA%, or non-standard system directories.
* Audit vsdbg.exe Process Trees: Query EDR telemetry for instances of vsdbg.exe running outside visual studio directories or spawning anomalous network connections.
3. User Education & Verified Software Acquisition
* Instruct all corporate personnel and developer teams to download password managers and authenticator applications exclusively from verified vendor websites or approved enterprise software portals (e.g., Company Portal, Jamf Self Service).
Sources and Reference Intelligence: BleepingComputer, The 420 Cyber News, CyberInsider.