Rapuncel Campaign Turns Trusted Windows Driver Into Security-Tool Weapon
A newly documented malware campaign is using fraudulent GitHub repositories and a Microsoft-attested kernel driver to disable endpoint protection before deploying the Rapuncel information stealer, researchers have found.
The operation, uncovered by LastPass Threat Intelligence, Mitigation and Escalation (TIME) and Delphos Labs, impersonated at least 40 technology companies.
Investigators first detected the activity on August 13, 2026, after identifying a fake GitHub organization posing as a source for LastPass Authenticator.
No LastPass systems, services or customer vaults were compromised.
Search Traffic Leads Victims to Fake Software
Attackers created search-optimized GitHub repositories designed to resemble legitimate software-download pages.
Victims following the fraudulent links were redirected through attacker-controlled infrastructure before receiving oversized ZIP archives, some reaching roughly 148 MB, a technique that can complicate automated security scanning.
The infection chain abuses a legitimate Microsoft Visual Studio debugging executable,vsdbg.exe, to sideload a malicious DLL. The loader subsequently installs Rapuncel alongside the kernel driver used to neutralize security products.
Signed Driver Targets 145 Security Processes
A central component is Alinubx.sys, which carries a Microsoft Windows Hardware Compatibility Publisher chain signature and was not included in Microsoft's vulnerable-driver blocklist when researchers conducted their analysis.
The driver contains a hardcoded list targeting 145 antivirus and EDR processes.
Kernel Access Helps Defeat Endpoint Protection
Researchers found that Alinubx can open targeted processes from kernel mode and terminate them, potentially bypassing protections—including Protected Process Light—that security software may rely on.
Analysis linked Alinubx to CcProtect.sys, a previously documented driver with similar process-killing functionality. Researchers found matching product and version information and the same underlying termination primitive despite the changed identity.
The finding illustrates a key defensive limitation: a valid driver signature establishes a chain of trust, but does not guarantee that the driver's functionality cannot be abused.
Rapuncel Harvests Credentials and Crypto Data
Once defenses are weakened, Rapuncel focuses on valuable authentication and financial information.
Researchers observed targeting of more than 25 browsers, along with browser credentials, cryptocurrency wallets, Windows Credential Manager data, Discord tokens, Telegram sessions and Steam information.
The malware also searches for documents whose filenames contain terms associated with sensitive secrets, including passwords, wallet information, seed phrases and recovery material.
Persistence through a Windows service enables the operation to survive reboots and potentially repeat the process of disabling defensive software.
Trust Signals Become Part of the Attack
The campaign is notable because several components appear legitimate when viewed independently: familiar software brands, GitHub repositories, search results, legitimate Microsoft tooling and a digitally signed driver.
Combined, those trust signals provide attackers with an effective route around defenses heavily dependent on reputation, filenames, signatures and known hashes.
For defenders, Rapuncel reinforces the need to evaluate driver behavior and provenance rather than signature status alone, while restricting unnecessary kernel-driver installation and monitoring unusual attempts to terminate EDR or antivirus processes.
The campaign ultimately demonstrates how attackers can weaponize legitimate trust mechanisms themselves—turning software authenticity signals into part of the intrusion chain.