Rapuncel Infostealer Killed 145 Security Tools Before Stealing Browser and Wallet Credentials

A newly documented Windows infostealer named Rapuncel is sweeping credentials off infected machines by first doing something most malware cannot: it silently terminates every major antivirus or endpoint detection tool running on the computer before it starts stealing. The weapon it uses is a Microsoft-signed kernel driver that scored zero detections on VirusTotal and did not appear on Microsoft's vulnerable driver blocklist — not because it was genuinely novel, but because its operators took a Chinese disk-encryption company's driver that security researchers had already documented with public proof-of-concept kill code, changed the filename, and resubmitted it through Microsoft's hardware compatibility program . The filename change generated a new hash. The blocklist never matched it. Every standard defense came back clean.

The campaign, disclosed jointly on September 17, 2026, by password-manager company LastPass and threat intelligence firm Delphos Labs, has been impersonating at least 40 software brands through fraudulent GitHub repositories since at least August 13, 2026. Among the names being spoofed are password managers, cryptocurrency applications, and mainstream productivity tools — any recognizable name that a user might for when looking for a software download.

The lede-level implication is worth stating directly: a driver already publicly documented with proof-of-concept kill code, already listed on a community security registry, and already used in prior campaigns walked past every hash-based gate simply by changing its filename. This is not an edge case or a gap that patching will close. It is a structural limitation of signature-based detection.

Why Signing a Driver Does Not Make It Safe

The kernel driver at the center of this campaign is called Alinubx.sys. Its job is to clear the field before Rapuncel runs: it opens 145 hardcoded antivirus and endpoint detection and response (EDR) processes from kernel mode and terminates them one by one, in a way that bypasses the main Windows protection mechanism that most security products rely on to survive an administrator.

That protection mechanism — Protected Process Light, or PPL — was introduced in Windows 8.1 specifically to stop malware from disabling antivirus software. When a security vendor's product runs as a PPL process, even a user with full system administrator access cannot terminate it through normal Windows interfaces, because the operating system blocks any attempt to open a handle to the process with the terminate-access right, as Elastic Security Labs documents for PPL . That protection exists only in user mode. At kernel mode — below the layer where security software operates — the rules are different.

Alinubx.sys reaches down into kernel mode and calls an internal Windows function, ObOpenObjectByPointer , with a parameter set to KernelMode per the joint report . This sidesteps the access-check that normally enforces PPL. The driver asks Windows to open each target process as if the kernel itself were making the request — because at that level, it is. Nothing stops it.

The driver is signed through Microsoft's Windows Hardware Compatibility Publisher chain. That signature is real: the driver passed through Microsoft's attestation process. But attestation confirms only that the driver went through a trust pipeline, not that it is safe to run. As Delphos Labs put it in their joint report with LastPass, "Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe."

A LOLDrivers-Listed Driver in Disguise

The structural failure that allowed Alinubx.sys to evade detection is specifically what makes it significant beyond this campaign. Security researchers had already documented the underlying driver it was derived from.

Alinubx.sys is a renamed and identity-adjusted version of CcProtect.sys, a process-protection driver distributed by Henan Dafeng Software Co., Ltd., a Chinese software company that makes disk encryption products under the CnCrypt brand per the joint report . CcProtect.sys is listed on LOLDrivers — the community-maintained registry of legitimate signed Windows drivers known to expose primitives that attackers can abuse — and has publicly available proof-of-concept kill code in a widely-mirrored GitHub repository.

The attackers changed the original filename from CcProtect.sys to Alinubx.sys , kept everything else — the product name CnCrypt, version 1.32, the Henan Dafeng submitter identity — and resubmitted through the Windows Hardware Compatibility Publisher program. That change was sufficient. A new filename produces a new file hash. The Microsoft blocklist, which is a list of known-bad hashes, had never seen this hash. VirusTotal's 72 engine scan returned zero detections. On disk the driver disguised itself as an NVIDIA graphics component named nvfsflt64.sys , registered under the service name NvFsFilter, according to BleepingComputer .

Delphos Labs checked 18 raw driver files from public BYOVD repositories, plus CcProtect.sys and Alinubx.sys, against the Microsoft blocklist downloaded on August 20, 2026 per the joint report . None matched, including the one with public proof-of-concept kill code. The reason is not a gap in the list — it is structural: the blocklist matches known hashes. Rename the driver, compile with a minor tweak, or swap one identifier string, and the hash changes. The list never catches up.

This technique — loading a legitimate signed driver to gain kernel-level control and disable endpoint protection — is called Bring Your Own Vulnerable Driver (BYOVD), and it has become the preferred method for attackers who need to neutralize security software before deploying ransomware, infostealers, or other payloads. A 2026 NDSS Symposium paper on BYOVD from the University of Milan and EURECOM documented that BYOVD attacks "typically fly under the radar" because public sandboxes and EDR systems only inspect user-mode activity.

How Victims Arrive: , Click, Compromised

The delivery chain exploits something users do every day: searching for software.

The campaign used -engine optimization techniques to push fraudulent GitHub organization pages to the top of results on Google and Bing for searches like "LastPass Authenticator download" or similar queries, as BleepingComputer reported . GitHub carries substantial inherent trust — developers and consumers treat .github.io and github.com as credible sources. The fake pages exploited that trust directly, displaying fabricated trust signals including "Authorized Access," "VirusTotal Approved," and "Secure Archive" badges alongside a spinning animation claiming to validate the user's session per the joint report .

Clicking the download button did not deliver the payload directly. Behind the visible interface, the page routed victims through a chain of additional GitHub Pages accounts acting as silent relay points, before reaching a Cloudflare-fronted traffic-director server that fetched the real payload location at runtime. This architecture meant the operators could rotate the actual malware server without rebuilding any visible lure infrastructure — a hallmark of a Malware-as-a-Service (MaaS) platform rather than a one-off campaign.

The primary payload server, albinofennel[.]com, was simultaneously hosting impersonation lure pages for at least 40 brands, with the page content generated dynamically from a JavaScript kit reading URL parameters per the joint report. LastPass appears to have been one of many simultaneous targets, not a specifically chosen one.

What finally downloaded was a ZIP archive inflated to between 127.9 MB and 148 MB — most of it junk padding per the joint report. Many automated security scanning services impose file-size limits and skip or time out on unusually large archives, so the padding served a specific evasion purpose.

Inside the Archive: Trust Laundering via Microsoft's Own Debugger

The archive presented what looked like a named software installer. The executable was actually Microsoft's own Visual Studio CoreCLR Debugger, vsdbg.exe , renamed as an installer . This is a standard behavior in Windows called DLL sideloading: when vsdbg.exe runs, Windows automatically loads a companion file, vsdbg.dll , from the same folder. The operators placed their malicious loader as vsdbg.dll , which Windows loaded without complaint because it was being requested by a trusted Microsoft executable.

The loader — a .NET NativeAOT-compiled binary rather than the standard .NET runtime format, specifically to make reverse engineering harder — then installed two components: the Rapuncel infostealer and Alinubx.sys, per the joint report . The loader attempted three different methods to obtain administrator access before proceeding. Once it ran as SYSTEM — the highest privilege level on a Windows machine — it installed the driver as the NvFsFilter service, the driver cleared the 145 antivirus targets, and Rapuncel ran unopposed.

The loader's full tooling was identified by Delphos Labs as matching the Cruciferra PUROSANGUE crypter package, previously documented by Proofpoint's Cruciferra analysis and eSentire's PUROSANGUE report . The 145-target kill list, the .reloc section payload storage, and the COM Elevation Moniker UAC bypass all match that documented kit.

What Rapuncel Actually Steals

With security software neutralized, Rapuncel worked through a systematic collection of everything of financial or account value on the machine. It harvested saved passwords from more than 25 web browsers, wallet data from more than 30 cryptocurrency applications, session tokens from Discord and Steam (launching Steam silently if it was not already running to extract credentials from memory), Telegram session data, the contents of Windows Credential Manager, and any document whose filename contained words like "password," "seed," "wallet," or "recovery" per the joint report . It also took a screenshot of every connected monitor and a detailed system profile.

Chrome and Edge present a specific technical challenge for infostealers because Google's app-bound encryption, introduced in 2024, is designed to prevent exactly this kind of credential extraction. Rapuncel addressed this by injecting a small helper DLL directly into the browser's running process and calling Chrome's own decryption service from inside it. Because the request appeared to originate from within a trusted browser process, the encryption was unlocked on the attacker's behalf.

All collected data was compressed into a ZIP archive and uploaded to an attacker-controlled IP address at 2.26.126[.]50 over raw TCP formatted to look like ordinary HTTP traffic.

Rapuncel then installed itself as a Windows service that runs every time the computer boots — checking for any security software that may have restarted and killing it again before running the credential-collection loop again. Standard antivirus cleanup on the infected machine is not effective for exactly this reason: the driver terminates the cleanup tool before it can act. Affected users need to boot into Safe Mode or use an offline recovery tool to remove the driver.

Is My Antivirus Still Running? And What Else Can This Driver Do?

The Alinubx.sys driver carries capabilities that were not activated in this campaign but are present in its code: file and registry hiding, DLL injection, driver and process interception, and network traffic interception and redirection through Windows Filtering Platform per the joint report. These features require a configuration file, Alinubx.ccf , that the operators did not deploy. If a future deployment includes that file, the same driver could be used as a full rootkit rather than just an antivirus killer.

Delphos Labs reported Alinubx.sys to Microsoft's Security Response Center on August 19, 2026. Microsoft's MSRC responded that the driver's behavior does not meet its definition of a security vulnerability, since the driver is not a Microsoft-owned component, and directed the report to the Windows Defender Security Intelligence driver submission channel for blocklist consideration. As of September 17, 2026, when the joint report was published, Alinubx.sys was still not present in the Microsoft vulnerable driver blocklist.

Family History: BoryptGrab's Successor?

The joint researchers did not attribute the campaign to a specific threat actor but identified meaningful technical overlaps with the BoryptGrab malware family that Trend Micro documented in March 2026. BoryptGrab used the same SEO-optimized fake GitHub repository structure, the same GitHub Pages download portals, the same oversized archive evasion, and the same Chrome Elevation Service bypass workflow for defeating app-bound encryption.

Delphos assessed with moderate confidence that Rapuncel is a BoryptGrab-related variant or sibling build — the behavioral and artifact-level overlap is strong, including shared collection artifact names (a misspelled "Filegraber" directory and a UserInformation.txt file with a BUILD NAME field), but the payloads are not byte-identical and do not hashes with Trend Micro's published indicators per the joint report. The key difference is the addition of the Alinubx.sys kernel driver — a component not present in documented BoryptGrab deployments. Rapuncel represents an evolution of that ecosystem with a substantially more capable evasion layer.

What LastPass Was Not Saying

LastPass moved quickly to clarify the limits of this campaign's impact: the company's own systems, services, and customer vaults were not involved or compromised per the joint report. The attack used LastPass's name and branding as a lure delivered entirely outside LastPass channels. The official LastPass Authenticator is distributed through lastpass.com and official app stores; GitHub is not a LastPass distribution channel.

The clarification matters because it points to the campaign's actual operating logic: the specific brand being impersonated is incidental. The kit's payload server was simultaneously running impersonation lures for at least 39 other companies. Whatever software a user searches for is a potential vector.

What Users and Security Teams Should Do

If a user downloaded and ran software via a GitHub repository found through a engine in the weeks since August 13, 2026, the guidance from the researchers is to treat every credential stored on that machine as potentially compromised, per the joint report. Password and session changes must happen from a separate, known-clean device, not the affected machine. Active sessions — on email accounts, cryptocurrency exchanges, and financial services — should be revoked. Cryptocurrency wallet seed phrases should be treated as exposed and wallets migrated to new addresses.

Because the driver operates at kernel level, conventional antivirus scanning of the infected machine cannot reliably remove it while Windows is running. Remediation requires booting into Safe Mode or using an external offline tool.

For enterprise security teams, defenders who use the following behavioral signals can catch this campaign independent of hash-based detection:

A file written to C:WindowsSystem32driversnvfsflt64.sys

A Windows service named NvFsFilter describing itself as an NVIDIA component while not carrying an NVIDIA certificate

vsdbg.exe spawning child processes that are not Microsoft tools

A PE file whose raw .reloc section is substantially larger than its declared relocation size, with a high concentration of bytes in the 0x50–0x5F range

Outbound TCP POST requests to 2.26.126[.]50 using /upload HTTP/1.1 framing (treat this as historical context for correlation, not a standalone block rule)

The broader implication for security architecture is this: any defense that depends on a lookup table — a hash blocklist, a VirusTotal score, a certificate chain check — can be defeated by an attacker willing to make one small change to a known-bad artifact. Alinubx.sys demonstrates that a driver already publicly documented with proof-of-concept kill code, already listed on a community security registry, and already used in prior campaigns can walk past every hash-based gate simply by changing its filename. Behavioral detection — monitoring what a driver does rather than what it is named — is the only layer that catches it.

Is My Security Software Good Enough Against BYOVD?

The short answer is: it depends on whether your endpoint security solution includes kernel-mode monitoring or hypervisor-level isolation that operates independently of user-mode processes. Standard antivirus products that rely on Protected Process Light for their own survival cannot defend against a kernel driver that bypasses PPL through KernelMode access. Organizations that have deployed endpoint detection platforms with hypervisor-enforced memory integrity checks, or that monitor Windows driver-load events at the kernel-telemetry level, have meaningful visibility that standard user-mode EDR products do not.

Frequently Asked Questions

What is the Rapuncel infostealer and who is at risk?

Rapuncel is a Windows credential-stealing malware distributed through fraudulent GitHub repositories that impersonate at least 40 well-known software brands. Any Windows user who searched for and downloaded software via a GitHub repository found in a engine result since August 13, 2026 could be at risk. The malware targets browsers (25+), cryptocurrency wallets (30+), Discord, Steam, Telegram, Windows Credential Manager, and documents containing words like "password," "seed," or "wallet" in their filenames.

How does Rapuncel get around antivirus software?

Before stealing anything, Rapuncel's installer loads a Microsoft-signed kernel driver called Alinubx.sys, which terminates 145 hardcoded antivirus and endpoint detection processes from kernel mode — the deepest level of the operating system, where security software's own self-protection mechanisms (specifically, Protected Process Light) do not apply. The driver was not detected by any of 72 antivirus engines on VirusTotal and was not listed on Microsoft's vulnerable driver blocklist, because it was derived from a known-bad driver with its filename changed, producing a new file hash that existing blocklists had never seen.

Why couldn't Microsoft's blocklist or VirusTotal catch this driver?

Both rely on matching file hashes: a lookup against a list of known-bad fingerprints. Changing a driver's filename changes its hash. The operators took CcProtect.sys — a Chinese disk-encryption company's process-protection driver already documented on LOLDrivers with public proof-of-concept kill code — renamed it Alinubx.sys, and resubmitted it through Microsoft's hardware compatibility program. The result was a clean VirusTotal score of 0 out of 72. This is a structural limitation of hash-based detection, not an oversight: any attacker who changes one byte of a known-bad file produces a new hash that blocklists and signature databases have never seen.

What should I do if I may have installed Rapuncel?

Change all passwords stored in your browser and any other accounts from a separate, clean device — not the infected machine, which may still be under attacker control. Revoke active sessions on email, financial, and cryptocurrency accounts. If you hold cryptocurrency, treat seed phrases as exposed and migrate funds to freshly generated wallets. security resources at your organization if on a corporate machine. For cleanup, standard antivirus running on the infected Windows machine is unlikely to fully remediate the driver because the driver will terminate it first; boot into Safe Mode or use an external offline recovery tool, and consider professional incident response if sensitive financial or corporate credentials may have been exposed.