● Covered by 3 sources · 3 reportsMedium impact3 negative
Fake GitHub Repositories Distribute Rapuncel Infostealer and Kernel Driver
Key points
- Campaign uses fake GitHub repos to spread malware.
- Rapuncel infostealer targets browser credentials and crypto wallets.
- Alinubx.sys kernel driver disables 145 security products.
- Driver is Microsoft-signed and bypasses Protected Process Light.
- Campaign impersonated over 40 organizations.
- Fake LastPass Authenticator discovered on August 13.
- Attackers used SEO optimization for GitHub page ranking.
- Attackers used a hidden routing chain with multiple GitHub pages and Cloudflare.
- Server was active and serving JavaScript redirect as of September 10.
- Driver scored zero detections on VirusTotal in August.
- Driver was not on Microsoft's list of blocked drivers.
- Fake installer uses renamed vsdbg.exe and malicious vsdbg.dll.
Malware Campaign Leverages Fake GitHub Repos
An ongoing malware campaign is distributing a new information stealer, Rapuncel, and a kernel driver by impersonating well-known software firms through SEO-optimized GitHub repositories. LastPass and Delphos Labs identified the campaign, which mimics the LastPass brand and at least 39 other companies.
Attack Chain and Evasion Techniques
Victims initiate the attack by searching for popular software like LastPass Authenticator, leading them to fake GitHub repositories. Clicking download buttons redirects users to payload-delivery servers, where they receive ZIP archives. These archives are inflated to up to 148MB to bypass security scans.
The installer inside the archives is a renamed Microsoft Visual Studio CoreCLR Debugger ('vsdbg.exe'), configured to sideload a malicious DLL ('vsdbg.dll'). This installer deploys both the Rapuncel infostealer and the Alinubx.sys kernel driver.
Alinubx.sys Kernel Driver Disables Security Software
The Alinubx.sys kernel driver, disguised as an NVIDIA component ('nvfsflt64.sys'), registers as the NvFsFilter service. It functions as an EDR killer, containing a hardcoded list of 145 antivirus and EDR processes that it attempts to terminate. The driver uses 'ObOpenObjectByPointer' with 'AccessMode=KernelMode' to bypass user-mode 'SeAccessCheck', allowing it to defeat Protected Process Light (PPL) protections.
The driver is currently not on Microsoft's vulnerable drivers blocklist and is signed through Microsoft's Windows Hardware Compatibility Publisher chain. While Alinubx.sys has additional capabilities like file/registry hiding and DLL injection, these are not active in the current campaign.
Rapuncel Infostealer Data Collection
After security software is disabled, the Rapuncel infostealer begins collecting data. It targets credentials stored in 25 web browsers and data from 30 cryptocurrency wallets on the infected device.
Updates
- Campaign impersonated over 40 organizations.
- Fake LastPass Authenticator discovered on August 13.
- Attackers used SEO optimization for GitHub page ranking.
- Attackers used a hidden routing chain with multiple GitHub pages and Cloudflare.
- Server was active and serving JavaScript redirect as of September 10.
- Driver scored zero detections on VirusTotal in August.
- Driver was not on Microsoft's list of blocked drivers.
- Fake installer uses renamed vsdbg.exe and malicious vsdbg.dll.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Researchers discovered a fake LastPass Authenticator installer on GitHub that deploys a Windows kernel driver to disable antivirus and EDR software before installing a password stealer. The driver is signed through Microsoft's hardware-compatibility program, allowing it to bypass security measures and operate at the kernel level. This incident highlights the risk of supply chain attacks and the challenge of trusting signed drivers, even from reputable sources.
A campaign impersonating over 40 organizations, including LastPass, distributed fake installers via GitHub that deploy a Microsoft-attested kernel driver designed to disable 145 security tools. This driver then facilitates the installation of the Rapuncel infostealer, which targets credentials from browsers, crypto wallets, and other applications. The campaign highlights the use of sophisticated techniques to bypass endpoint security and exfiltrate sensitive user data.
A malware campaign uses SEO-optimized GitHub repositories impersonating legitimate companies to distribute a new infostealer called Rapuncel and a Microsoft-signed kernel driver. The kernel driver, Alinubx.sys, disables 145 antivirus and EDR products, allowing Rapuncel to steal credentials and cryptocurrency wallet data.