Fake LastPass GitHub Repos Push Rapuncel Stealer & EDR Killer

Executive Summary

Threat intelligence researchers at LastPass and Delphos Labs have uncovered an aggressive malware distribution campaign leveraging search-engine-optimized (SEO) fraudulent GitHub repositories to distribute a potent, previously undocumented information stealer named Rapuncel. The adversaries created dozens of weaponized repositories masquerading as official source code and release portals for LastPass Authenticator alongside at least 39 other high-profile software brands, including VPN clients, developer utilities, and password management tools.

The infection vector is engineered to systematically dismantle host defenses. The dropped package abuses a legitimate Microsoft Visual Studio CoreCLR Debugger binary (vsdbg.exe) to sideload malicious DLL payloads, subsequently deploying a Microsoft-signed Windows kernel driver named `Alinubx.sys` (masquerading as an NVIDIA driver, nvfsflt64.sys). Operating at Ring 0, the driver conducts a Bring Your Own Vulnerable Driver (BYOVD) attack that terminates over 145 antivirus, EDR, and endpoint monitoring processes by abusing kernel-mode handle elevation. Once security software is silenced, the Rapuncel infostealer systematically plunders web browser credentials, 30+ cryptocurrency wallets, Telegram session databases, Discord tokens, and sensitive desktop files.

Technical Vulnerability Analysis & Attack Chain

The Rapuncel campaign integrates open-source repository SEO manipulation, file bloating evasion, DLL sideloading, and kernel-level defense termination:

[SEO-Poisoned Google/Bing Search Query]

│

▼

[Fake GitHub Repository (e.g. LastPass Authenticator)]

- Official Logos, Badges, Star/Fork Padding

│

▼

[Download Redirection: Bloated 148MB ZIP Archive]

- Padded File Size Bypasses Automated Sandbox Scans

│

▼

[Stage 1: DLL Sideloading via Microsoft vsdbg.exe]

- Legitimate vsdbg.exe Executes Malicious vsdbg.dll

│

▼

[Stage 2: Ring 0 BYOVD EDR Killer (Alinubx.sys)]

- Microsoft WHQL Signed Driver Masquerades as NvFsFilter (nvfsflt64.sys)

- ObOpenObjectByPointer(KernelMode) Bypasses Protected Process Light (PPL)

- Forcefully Terminates 145 Antivirus & EDR Processes

│

▼

[Stage 3: Rapuncel Infostealer Execution & Data Exfiltration]

- 25+ Browsers (Passwords, Cookies, Autofill, Payment Cards)

- 30+ Crypto Wallets (Private Keys, Seed Phrases, Vault JSONs)

- Session Tokens (Telegram tdata, Discord, Steam)

- Windows Credential Manager DPAPI & Keyword-Targeted Documents

1. Repository Brand Impersonation & File Inflation

Threat actors register disposable GitHub organizations and accounts hosting repositories populated with authentic logos, README documentation, release tags, and artificial star/fork counts to manipulate search engine indexing. When victims search for utilities like "LastPass Authenticator Windows," these GitHub repositories frequently appear at the top of search results.

Clicking the download link routes victims through multi-stage redirectors that serve bloated ZIP archives ranging between 128 MB and 148 MB. This deliberate file inflation exceeds the maximum upload threshold for most automated cloud sandboxes and endpoint security scanners, allowing the payload to pass uninspected to the endpoint.

2. DLL Sideloading via Microsoft Visual Studio Debugger

Inside the extracted archive, the primary executable is a renamed, authentic Microsoft binary: vsdbg.exe (the Visual Studio CoreCLR Debugger). Upon execution, vsdbg.exe searches its current working directory for its standard companion dependency and inadvertently sideloads an attacker-crafted malicious DLL: vsdbg.dll.

Because the parent process is a legitimate, digitally signed Microsoft application, the execution avoids common behavioral heuristic alerts from legacy endpoint protection platforms.

3. Kernel-Mode EDR Termination via Alinubx.sys (BYOVD)

To ensure uninterrupted data theft, vsdbg.dll extracts and installs a malicious kernel driver:

• Driver Masquerading: The driver is named Alinubx.sys but is dropped to disk as nvfsflt64.sys, registering a deceptive Windows kernel service named NvFsFilter to blend in with legitimate NVIDIA graphics filesystem filters.
• Microsoft Signature: Crucially, Alinubx.sys carries a valid cryptographic signature issued through the Microsoft Windows Hardware Compatibility Publisher (WHQL) certificate chain, allowing it to load seamlessly on 64-bit Windows systems with Driver Signature Enforcement (DSE) enabled.
• PPL Bypass & EDR Kill Routine: Modern EDR agents run as Protected Process Light (PPL), preventing even local NT AUTHORITY\SYSTEM administrators from terminating them via userspace APIs. Operating at Ring 0, Alinubx.sys calls ObOpenObjectByPointer with AccessMode = KernelMode, acquiring full PROCESS_TERMINATE rights over protected process handles. It iterates through a hardcoded blocklist of 145 security processes—including Microsoft Defender, CrowdStrike Falcon, SentinelOne, Carbon Black, Sophos, Trend Micro, and Symantec—terminating them abruptly.

4. Rapuncel Credential & Asset Harvesting Engine

With host defenses dismantled, the primary Rapuncel payload executes:

• Browser Theft: Targets SQLite databases, local state files, and DPAPI-protected MasterKeys across 25+ Chromium and Gecko browsers (Chrome, Edge, Brave, Opera, Firefox, Vivaldi, Yandex), decrypting saved passwords, active session cookies, and credit cards.
• Cryptocurrency Wallets: Targets 30+ browser extension and desktop cold/hot wallets (MetaMask, Phantom, Binance, Coinbase Wallet, Exodus, Atomic, Trust Wallet), copying seed phrases and encrypted wallet vaults.
• Session Tokens: Extracts Discord authentication tokens, Steam gaming login session keys, and complete Telegram Desktop session databases (%APPDATA%\Telegram Desktop\tdata).
• File System Grep: Recursively traverses user directories (Desktop, Documents, Downloads), scanning for files matching sensitive naming conventions: *pass*, *wallet*, *seed*, *secret*, *recovery*, *key*.
• Exfiltration: Archives stolen data into encrypted archives and exfiltrates them via HTTP POST requests to remote command-and-control (C2) servers.

Threat Actor Profile & Campaign Attribution

• MaaS Operation: Threat telemetry indicates the campaign is orchestrated by an organized cybercrime group operating a Malware-as-a-Service (MaaS) distribution model. The wide variety of 40+ impersonated software vendors indicates opportunistic, broad-spectrum enterprise targeting rather than a single targeted espionage campaign.
• BoryptGrab Lineage: Delphos Labs identified significant architectural, staging, and code overlaps with the BoryptGrab malware operation documented by Trend Micro in March 2026, indicating that Rapuncel is an upgraded iteration developed by the same author.
• LastPass Clarification: LastPass confirmed that their corporate infrastructure, customer authentication services, and password vaults were not breached or compromised; the threat actors solely exploited LastPass brand equity to trick unsuspecting search engine users.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Enforce Microsoft Vulnerable Driver Blocklist:
  • Enable the Microsoft Recommended Driver Blocklist via Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI / Memory Integrity) to block known abused and vulnerable drivers:

// Verify HVCI Memory Integrity Status

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

• Deploy Driver Hash Blacklists:
  • Explicitly block driver hashes associated with Alinubx.sys and nvfsflt64.sys in enterprise EDR and AppLocker policies.
• Developer & User Hygiene:
  • Educate developers and engineers to download software exclusively from verified vendor homepages and authorized enterprise software catalogs, avoiding third-party GitHub mirrors for commercial closed-source software.

2. Network & Perimeter Defenses

• Block Known Malicious Staging Domains: Block external staging URLs associated with the fake GitHub release redirectors.
• Inspect Large Archive Downloads: Reconfigure Secure Web Gateways (SWG) to uncap or increase scanning thresholds for ZIP and RAR archives exceeding 100 MB.
• Snort / Suricata Rule for Rapuncel C2 Beaconing:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Rapuncel Infostealer Data Exfiltration Post"; flow:to_server,established; content:"POST"; http_method; content:"/gate"; http_uri; content:"Content-Type: multipart/form-data"; http_header; content:"User-Agent: Rapuncel"; http_header; classtype:trojan-activity; sid:20261019; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Masqueraded NVIDIA Kernel Driver Installation

title: Suspicious Driver Registration Masquerading as NvFsFilter

status: experimental

description: Detects creation of the malicious NvFsFilter service loading Alinubx.sys disguised as nvfsflt64.sys.

logsource:

category: process_creation

product: windows

detection:

selection_sc:

Image|endswith: '\sc.exe'

CommandLine|contains:

- 'create'

- 'NvFsFilter'

- 'nvfsflt64.sys'

selection_reg:

TargetObject|contains: 'SYSTEM\CurrentControlSet\Services\NvFsFilter'

condition: selection_sc or selection_reg

level: critical

tags:

- attack.persistence

- attack.defense_evasion

- attack.t1543.003

- attack.t1068

Splunk Hunting Query: Visual Studio Debugger Sideloading

index=endpoint (EventCode=1 OR EventCode=4688)

| eval Process=lower(NewProcessName), Parent=lower(ParentProcessName)

| where match(Process, "vsdbg\.exe$") AND NOT match(Parent, "(devenv|visualstudio|dotnet)\.exe$")

| table _time, Computer, Account, NewProcessName, CommandLine, ParentProcessName