Rapuncel Infostealer: The Microsoft-Signed Kernel Driver That Kills 145 Security Products Before It Steals

The fake installer problem just got worse. LastPass and Delphos Labs found GitHub repos posing as LastPass Authenticator that ship a signed Windows kernel driver built to switch off 145 security products before a stealer empties the machine.

Malware that impersonates popular software is old news. Malware that walks in with a valid Microsoft signature and a kernel-mode kill list is not. On September 18, LastPass and Delphos Labs published findings on an ongoing campaign that uses SEO-boosted GitHub repositories to push a previously undocumented infostealer they named Rapuncel, alongside a kernel driver that terminates 145 antivirus and EDR processes. The repos impersonate LastPass and at least 39 other well-known companies.

The lure: search results you can’t trust

The chain starts the way most enterprises already lose laptops. Someone needs LastPass Authenticator, searches for it, and lands on a GitHub repository that looks official. The README is polished, the download button works, and the repo ranks well enough to sit near the real thing. Clicking download kicks off a series of redirects that ends at a payload server handing back a ZIP archive inflated to as much as 148 MB, a trick used to slip past scanners that give up on oversized archives.

Inside the archive sits what looks like vsdbg.exe, the genuine Microsoft Visual Studio CoreCLR debugger. The binary is legitimate. What makes it malicious is a side-loaded vsdbg.dll that loads the moment the “installer” runs.

The weapon: a signed driver that kills Protected Processes

The payload drops a kernel driver, Alinubx.sys, disguised as an NVIDIA component called nvfsflt64.sys and registered under the service name NvFsFilter. LastPass’s analysis of the driver is worth reading twice. It calls ObOpenObjectByPointer with AccessMode set to KernelMode, which skips the normal user-mode access check when opening a process handle. The driver asks the kernel to open the security product’s process as kernel code, then terminates it. That is how it defeats Protected Process Light, the protection tier most endpoint tools rely on to survive even a local administrator.

Worse for compliance teams: the driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain, and it is not on Microsoft’s vulnerable driver blocklist. Signature revocation and HVCI policies, the controls most of our baselines lean on, do not stop it today.

The theft: beating browser encryption with the browser itself

With the endpoint sensors dead, Rapuncel gets to work. To bypass Chrome’s app-bound encryption, the protection that keeps browser-stored passwords from being read outside the browser, it injects a helper DLL into the running browser and invokes Chrome’s own Elevation Service to decrypt the data for it. It then compresses what it stole and ships it to 2.26.126[.]50 over a raw TCP connection dressed up as HTTP. A Windows service keeps it alive across reboots, and it kills any security tool that comes back before launching again.

Researchers assess with moderate confidence that Rapuncel is a variant of BoryptGrab, with a loader built using the Cruciferra PUROSANGUE crypter. The driver carries unactivated capabilities for file and registry hiding, DLL injection, and traffic manipulation. This is a platform, not a one-off.

What this means for African enterprises

Most of the organisations we work across South Africa do not block GitHub downloads, and most staff laptops can reach it freely. The campaign’s whole economics depend on that. Download hygiene training helps at the edges, but the hard lessons here are structural.

• Signature trust is not inspection. A Microsoft-signed kernel driver can still be the malware. Endpoint policy needs to care where binaries load code from, not just who signed them.
• The kill happens before the theft. There is a window, however short, where the EDR agent is dead and the stealer is not. Egress monitoring catches what host sensors miss: a workstation that has never spoken to 2.26.126[.]50 suddenly doing so over raw TCP at 2am is the signal.
• Browser vaults are not a password strategy. App-bound encryption slowed Rapuncel down for exactly as long as a DLL injection takes. Centralised, hardware-backed credential management beats vaults that live on the laptop.

The eHawu position

Rapuncel proves what we keep saying about endpoints: they are contested assets, not trusted ones. eHawu was built on that premise. Our network layer inspects what leaves the device, not what the device claims about itself. When a workstation with a dead antivirus agent starts pushing encrypted batches to an unfamiliar IP, that traffic hits eHawu’s inspection before it hits the attacker’s server. Authenticator apps, installers, and updates belong on an allow-list of official sources. Everything else should look strange, and with eHawu in the path, it does.