A malware campaign tracked as Rapuncel is abusing a Microsoft-attested kernel driver to disable endpoint protections before stealing credentials, cryptocurrency wallet data, messaging tokens, and sensitive files from infected Windows devices.
Researchers from the LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team and Delphos Labs identified the operation after uncovering fraudulent GitHub pages impersonating LastPass Authenticator.
The campaign used search-optimized repositories and GitHub Pages sites to lure victims into downloading fake installers, but its infrastructure supported impersonation pages for at least 40 brands.
Rapuncel Infostealer Uses Signed Kernel Driver
The attack begins when a user searches for software such as “LastPass Authenticator download” and reaches a counterfeit GitHub organization.
A prominent download button redirects victims through several GitHub Pages waypoints before delivering a large ZIP archive from attacker-controlled infrastructure.
Those archives, ranging from roughly 127 MB to 148 MB, contain legitimate-looking files and junk data intended to exceed automated scanner size limits.
Hidden among the padding is a renamed Microsoft debugging executable, vsdbg.exe, and a malicious companion DLL, vsdbg.dll. Windows loads the attacker-controlled DLL through DLL side-loading when the fake installer is executed.
The loader attempts multiple privilege-escalation techniques and, after obtaining SYSTEM-level access, installs a kernel driver named Alinubx.sys. Dropped as nvfsflt64.sys, the driver masquerades as an NVIDIA File System Filter Driver and creates a service named NvFsFilter.
Alinubx.sys is particularly concerning because it is signed through the Microsoft Windows Hardware Compatibility Publisher chain. Its trusted signature and previously clean reputation helped it evade security controls.
However, the driver exposes an IOCTL interface that allows the malware to terminate processes from kernel mode. The loader contains 145 hardcoded antivirus and endpoint detection and response process names.
It sends target process IDs to the driver, which opens and terminates them using kernel-level access. This approach can bypass protections such as Protected Process Light, allowing the malware to remove security tooling before credential theft begins.
With defenses disabled, Rapuncel targets saved browser credentials, including those protected by Chrome and Edge app-bound encryption. The malware injects a helper DLL into browser processes and invokes the browser’s own decryption services, making the request appear legitimate.
The stealer also harvests cryptocurrency wallet files from more than 30 applications, Discord tokens, Steam session data, Telegram information, Windows Credential Manager entries, screenshots, system details, and documents containing terms such as “password,” “seed,” “wallet,” or “recovery.” The loader compresses the collected data and uploads it to a dedicated command-and-control server.
LastPass found technical overlap between the loader and the Cruciferra PUROSANGUE crypter ecosystem, including DLL side-loading, NativeAOT payload handling, UAC bypass behavior, persistence, and security-tool killing.
The campaign also shares delivery and credential-theft characteristics with BoryptGrab, although the relationship remains unconfirmed. Defenders should hunt for Alinubx.sys, ProtectR3.dll, NvFsFilter, nvfsflt64.sys, and suspicious use of vsdbg.exe.
Organizations should also monitor for newly installed Microsoft-attested drivers, especially those with CnCrypt or Henan Dafeng Software metadata, and investigate any unexpected termination of security processes from kernel mode.
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-256 | ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6 | vsdbg.dll — .NET NativeAOT loader |
| SHA-256 | aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd | Rapuncel credential stealer |
| SHA-256 | 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61 | Alinubx.sys kernel driver |
| Domain | albinofennel[.]com | Primary malware-as-a-service payload server |
| Domain | istatlmenus[.]com | Dynamic redirect/C2 layer |
| IP address | 2.26.126[.]50 | Rapuncel exfiltration endpoint using raw TCP POST requests to /upload |
| File path | C:\Windows\System32\drivers\nvfsflt64.sys | Dropped Alinubx driver masquerading as an NVIDIA component |
| Service/device | NvFsFilter / \\.\Alinubx | Driver service name and kernel IOCTL device interface |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
