Fake GitHub Repositories Deliver Rapuncel Infostealer and Disable 145 Security Products

An ongoing malware campaign is using SEO-optimized GitHub repositories to impersonate LastPass and at least 39 other companies. The campaign delivers a previously undocumented information stealer called Rapuncel.

LastPass and Delphos Labs discovered the campaign and reported that it targets people searching for LastPass Authenticator and other popular software.

The malicious repositories distribute Rapuncel alongside Microsoft-signed kernel drivers capable of disabling 145 antivirus and endpoint detection and response (EDR) products.

How the fake GitHub software downloads work

The attack begins when a victim searches for LastPass Authenticator or another popular application and follows a link to a fake GitHub repository.

Clicking the repository’s download button triggers a series of redirects before the victim reaches the payload delivery server. The victim then receives a ZIP archive that is inflated to as much as 148 MB to evade security scans.

The archive contains a copy of the genuine Microsoft Visual Studio CoreCLR debugger, vsdbg.exe. The file has been renamed and configured to sideload a malicious DLL named vsdbg.dll.

The installer deploys the Rapuncel information stealer and the Alinubx.sys kernel driver, which is used to terminate antivirus and EDR software.

Microsoft-signed driver kills antivirus and EDR processes

The kernel driver is disguised as an NVIDIA component named nvfsflt64.sys and registered as the NvFsFilter service.

According to researchers, the driver functions as an EDR killer and contains a hard-coded list of 145 antivirus and EDR processes to terminate.

“The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck pass when opening a handle.” Learn more from LastPass.

“It asks the kernel to open the process as kernel code and then kills the process. This allows it to defeat Protected Process Light (PPL), a protection that many security products rely on to keep administrators alive.”

The driver is not currently included on Microsoft’s vulnerable driver blocklist. The version used in this campaign is signed through Microsoft’s Windows Hardware Compatibility Publisher chain.

Researchers also found that Alinubx.sys includes capabilities for file and registry hiding, DLL injection, driver and process interception, traffic manipulation, and port redirection. However, those features do not appear to have been enabled in this campaign.

What data does the Rapuncel infostealer steal?

After security software is terminated, Rapuncel begins collecting sensitive information from the infected device.

The malware can steal:

• Credentials stored in 25 web browsers
• Data from 30 cryptocurrency wallets
• Discord, Steam, and Telegram session credentials
• Contents of Windows Credential Manager
• Documents containing “password,” “seed,” “wallet,” or “recovery” in their filenames
• Screenshots from all connected monitors
• Detailed system information

To bypass Google’s app-binding encryption protections in Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the application and calls its own elevation service.

The stolen information is compressed and uploaded to an external endpoint, 2.26.126[.]50, using HTTP-style requests sent over raw TCP.

Rapuncel maintains persistence through Windows Services. As a result, any security tools that restart can be terminated again before the infostealer begins running.

Rapuncel linked to BoryptGrab

LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of BoryptGrab. The researchers also found that its loader was built using the Cruciferra PUROSANGUE encryption program.

How to avoid fake GitHub malware downloads

Users should download software only from official websites, avoid questionable GitHub repositories, and skip or block promoted results in Google Search when looking for software.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Reserve your seat