Rapuncel Malware Campaign Abuses Microsoft-Signed Kernel Driver to Disable Security Tools
A sophisticated malware campaign, tracked as Rapuncel, is leveraging a Microsoft-attested kernel driver to disable endpoint protections before stealing credentials, cryptocurrency wallet data, messaging tokens, and sensitive files from infected Windows devices.
Researchers from LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team and Delphos Labs uncovered the operation after discovering fraudulent GitHub pages impersonating LastPass Authenticator. The campaign employed search-optimized repositories and GitHub Pages to distribute fake installers, with infrastructure supporting impersonation pages for at least 40 brands.
Attack Chain & Evasion Tactics
Victims searching for software like "LastPass Authenticator download" are redirected to counterfeit GitHub organizations. A prominent download button leads through multiple GitHub Pages before delivering a large ZIP archive (127–148 MB), designed to bypass automated scanners by padding legitimate files with junk data.
The archive contains a renamed Microsoft debugging executable (vsdbg.exe) and a malicious DLL (vsdbg.dll), which loads via DLL side-loading. The malware then employs privilege-escalation techniques to gain SYSTEM-level access and install a kernel driver, Alinubx.sys, disguised as an NVIDIA File System Filter Driver (nvfsflt64.sys).
The driver, signed via the Microsoft Windows Hardware Compatibility Publisher chain, exposes an IOCTL interface that allows the malware to terminate 145 hardcoded antivirus and EDR processes from kernel mode bypassing protections like Protected Process Light.
Data Theft & Command-and-Control
With security tools disabled, Rapuncel targets:
- Browser credentials (Chrome, Edge) via app-bound encryption bypass
- Cryptocurrency wallet files from 30+ applications
- Discord tokens, Steam sessions, Telegram data
- Windows Credential Manager entries
- Screenshots, system details, and documents containing keywords like "password," "seed," or "wallet"
Stolen data is compressed and exfiltrated to a dedicated C2 server (albinofennel[.]com) via raw TCP POST requests.
Attribution & Overlaps
LastPass identified technical overlaps between Rapuncel and the Cruciferra PUROSANGUE crypter ecosystem, including DLL side-loading, NativeAOT payload handling, and UAC bypass techniques. The campaign also shares similarities with BoryptGrab, though the relationship remains unconfirmed.
Indicators of Compromise (IOCs)
- SHA-256 Hashes:
ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6(vsdbg.dll – .NET NativeAOT loader)aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd(Rapuncel credential stealer)611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61(Alinubx.sys kernel driver)
- Domains:
albinofennel[.]com(primary C2 server)istatlmenus[.]com(dynamic redirect/C2 layer)
- IP Address:
2.26.126[.]50(exfiltration endpoint) - File Path:
C:\Windows\System32\drivers\vfsflt64.sys(dropped driver) - Service/Device:
NvFsFilter/\\.\Alinubx(kernel IOCTL interface)
Defenders are advised to monitor for newly installed Microsoft-attested drivers, particularly those with CnCrypt or Henan Dafeng Software metadata, and investigate unexpected termination of security processes from kernel mode.
Source: https://cyberpress.org/rapuncel-infostealer-uses-signed-kernel-driver/
LastPass TPRM report: https://www.rankiteo.com/company/lastpass
"id": "las1789993838",
"linkid": "lastpass",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Password Management',
'name': 'LastPass',
'type': 'Cybersecurity Company'},
{'location': 'Global (Windows users)',
'type': 'End Users'}],
'attack_vector': ['DLL side-loading',
'Search-optimized GitHub repositories',
'Fake installers'],
'data_breach': {'data_exfiltration': 'Compressed data exfiltrated to C2 '
'server (albinofennel[.]com)',
'file_types_exposed': ['Browser databases',
'Wallet files',
'Session tokens',
'Documents'],
'personally_identifiable_information': 'Yes (credentials, '
'tokens, system '
'details)',
'sensitivity_of_data': 'High (PII, financial data, '
'authentication tokens)',
'type_of_data_compromised': ['Credentials',
'Cryptocurrency wallet data',
'Messaging tokens',
'Sensitive files']},
'description': 'A sophisticated malware campaign, tracked as *Rapuncel*, is '
'leveraging a Microsoft-attested kernel driver to disable '
'endpoint protections before stealing credentials, '
'cryptocurrency wallet data, messaging tokens, and sensitive '
'files from infected Windows devices. The campaign employed '
'search-optimized repositories and GitHub Pages to distribute '
'fake installers, impersonating at least 40 brands including '
'LastPass Authenticator.',
'impact': {'brand_reputation_impact': 'Impersonation of 40+ brands (e.g., '
'LastPass Authenticator)',
'data_compromised': ['Browser credentials',
'Cryptocurrency wallet files',
'Discord/Steam/Telegram tokens',
'Windows Credential Manager entries',
'Sensitive documents'],
'identity_theft_risk': 'High (PII and credential exposure)',
'operational_impact': 'Disruption of security tools via '
'kernel-mode termination',
'systems_affected': 'Windows devices with endpoint protections '
'disabled'},
'initial_access_broker': {'backdoors_established': 'DLL side-loading, kernel '
'driver installation',
'entry_point': 'Fraudulent GitHub Pages '
'impersonating brands',
'high_value_targets': ['Credentials',
'Cryptocurrency wallets',
'Messaging tokens']},
'investigation_status': 'Ongoing',
'lessons_learned': 'Abuse of Microsoft-signed kernel drivers can bypass '
'endpoint protections; need for monitoring kernel-mode '
'process termination and suspicious driver installations.',
'motivation': ['Data theft',
'Credential harvesting',
'Cryptocurrency wallet compromise'],
'post_incident_analysis': {'corrective_actions': ['Enhanced monitoring of '
'kernel-mode activity',
'Stricter validation of '
'Microsoft-attested drivers',
'Improved detection of DLL '
'side-loading techniques'],
'root_causes': ['Abuse of Microsoft-signed kernel '
'driver for privilege escalation',
'DLL side-loading to bypass '
'security tools',
'Search-optimized fake GitHub '
'repositories for malware '
'distribution']},
'ransomware': {'data_exfiltration': 'Yes'},
'recommendations': ['Monitor for newly installed Microsoft-attested drivers '
'with suspicious metadata',
'Investigate unexpected termination of security processes '
'from kernel mode',
'Block IOCs (domains, IPs, hashes) at network and '
'endpoint levels',
'Educate users on risks of downloading software from '
'unofficial sources'],
'references': [{'source': 'LastPass Threat Intelligence, Mitigation, and '
'Escalation (TIME) Team'},
{'source': 'Delphos Labs'}],
'response': {'enhanced_monitoring': 'Monitor for newly installed '
'Microsoft-attested drivers with '
'suspicious metadata (e.g., CnCrypt, '
'Henan Dafeng Software)',
'third_party_assistance': 'LastPass Threat Intelligence, '
'Mitigation, and Escalation (TIME) '
'Team; Delphos Labs'},
'threat_actor': 'Unconfirmed (Technical overlaps with Cruciferra PUROSANGUE '
'crypter ecosystem and BoryptGrab)',
'title': 'Rapuncel Malware Campaign Abuses Microsoft-Signed Kernel Driver to '
'Disable Security Tools',
'type': 'Malware Campaign',
'vulnerability_exploited': 'Microsoft-signed kernel driver (Alinubx.sys) '
'abuse via IOCTL interface'}