Fake GitHub repos spread Rapuncel infostealer, kill antivirus

Fake GitHub repositories that pose as the download pages of well known software are spreading a new infostealer called Rapuncel, and the same operation installs a Microsoft-signed kernel driver that disables antivirus protection on the infected machine. The campaign was uncovered by the password manager vendor LastPass together with the security firm Delphos Labs, and was reported by BleepingComputer on September 18, 2026. According to that research, the fake repositories impersonate LastPass and at least 39 other companies, and they are built to rank well in search results, so a victim often reaches them simply by typing the name of a popular program into a search engine.

The chain begins with that search. Someone looking for LastPass Authenticator, or for another widely used tool, follows a link that looks like an ordinary GitHub repository. Pressing the download button on the fake page does not deliver a file directly: it triggers a series of redirections that end at servers controlled by the attackers. Those servers return ZIP archives whose size has been inflated to as much as 148 megabytes, a technique meant to make automatic security scanning harder. Inside the archive is an installer that is in fact a renamed copy of vsdbg.exe, the legitimate Microsoft Visual Studio CoreCLR Debugger. The program has been set up to sideload a malicious library called vsdbg.dll, which means a trusted Microsoft tool is abused to load a file supplied by the attacker.

The installer also drops a kernel driver, a piece of software that runs at one of the deepest privilege levels in Windows, beneath ordinary applications, where security products find it very difficult to remove. The file is called Alinubx.sys but is disguised as an NVIDIA component under the name nvfsflt64.sys, and it registers itself as a service named NvFsFilter. LastPass states that the driver acts as an EDR killer and carries a hardcoded list of 145 antivirus and endpoint detection and response processes that it tries to terminate. In its explanation, LastPass describes how the driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time. The driver asks the kernel to open the process as kernel code and then kills it, which is why it can defeat Protected Process Light, the protection that many security products rely on to survive even an administrator. The driver is not currently in Microsoft's blocklist of vulnerable drivers, and the copy used in the campaign is signed through Microsoft's Windows Hardware Compatibility Publisher chain, so Windows treats it as trustworthy. Alinubx.sys also contains code for hiding files and registry entries, injecting libraries, intercepting drivers and processes, manipulating traffic and redirecting ports, but LastPass says those capabilities do not appear to be activated in this campaign.

With the security software stopped, Rapuncel starts collecting data. According to LastPass and Delphos Labs, it takes credentials saved in 25 web browsers, data from 30 cryptocurrency wallets, session credentials for Discord, Steam and Telegram, the contents of Windows Credential Manager, documents whose names contain the words password, seed, wallet or recovery, screenshots of every connected monitor, and detailed information about the system. To get past the app-bound encryption that Google uses to protect saved passwords in Chrome, Edge and related browsers, Rapuncel injects a helper library into the browser and starts its own Elevation Service. The collected data is compressed and uploaded to a server at 2.26.126[.]50 in a request formatted like ordinary web traffic but sent over a raw TCP connection. The malware also survives reboots by registering as a Windows service, so any security tool that comes back to life is terminated again before the infostealer runs.

LastPass and Delphos Labs said they assessed with moderate confidence that Rapuncel is a variant of an existing family called BoryptGrab, and that its loader was built with a crypter named Cruciferra PUROSANGUE, a tool designed to wrap malicious code so that scanners struggle to recognise it. Their advice to users is straightforward: download software only from official websites, avoid dubious GitHub repositories, and skip or block promoted results in Google Search. The wider point is that this attack does not break into a computer through a flaw in Windows; it succeeds because a trusted looking download page, sitting on a platform that most people associate with open source code, is used to hand over the malicious files.

For IT teams that would rather not rely on a single layer of endpoint protection, AEU-I, the group's security-first IT and infrastructure consulting service, works with organisations on this kind of infrastructure and security review, and its service page sets out what it covers. Whether that help is needed or not, the practical first step remains the same for everyone: treat the download page, not the operating system, as the place where this campaign wins or loses.