New Rapuncel malware campaign exploits SEO-poisoned GitHub repositories to disable enterprise security and harvest sensitive credentials
A sophisticated and highly deceptive malware campaign has been uncovered by researchers at LastPass and Delphos Labs, revealing a coordinated effort to compromise user systems through search engine optimization (SEO) manipulation. The attackers are leveraging fraudulent GitHub repositories to impersonate well-known technology brands, specifically targeting individuals seeking legitimate software downloads. This campaign serves as the delivery vector for a previously undocumented information-stealing malware dubbed "Rapuncel," which is deployed alongside a powerful, Microsoft-signed kernel driver capable of systematically dismantling enterprise-grade security suites.
The operational scope of this campaign is significant, with investigators identifying impersonation attempts against at least 39 distinct software firms. By poisoning search results, the threat actors ensure that users searching for popular tools—such as the LastPass Authenticator—are directed toward malicious repositories that appear authentic at first glance. This breach of trust highlights an evolving trend in cyber-espionage, where threat actors move away from traditional phishing emails in favor of poisoning the organic discovery channels that users rely on for software acquisition.
The Anatomy of the Attack Chain
The attack begins with a meticulously crafted SEO-poisoning strategy. Threat actors populate GitHub repositories with metadata, keywords, and code structures designed to rank highly in search engine results for legitimate software. When a victim clicks on these links, they are not taken directly to a download; instead, they are funneled through a series of automated redirections. These redirects serve to obfuscate the final destination and bypass automated security filters that monitor for malicious URL patterns.
Upon reaching the final payload-delivery server, the user is prompted to download a ZIP archive. To further evade signature-based detection, the attackers have inflated these archives to approximately 148MB. Many automated security tools and sandbox environments possess file-size limits; by exceeding these thresholds with junk data, the attackers ensure the malicious payload remains unexamined by basic perimeter defenses.
Once the victim extracts the archive, the deception continues. The primary installer is a legitimate Microsoft binary: the Visual Studio CoreCLR Debugger (vsdbg.exe). The attackers repurpose this signed binary to perform "DLL sideloading," a common technique where a legitimate executable is forced to load a malicious library (vsdbg.dll) that shares a filename with a dependency the executable expects. Once vsdbg.exe runs, it unwittingly triggers the installation of the Rapuncel infostealer and a secondary malicious kernel driver, Alinubx.sys.
The Role of the Kernel Driver: Neutralizing Defense
The most alarming aspect of the Rapuncel campaign is the deployment of the Alinubx.sys kernel driver, which acts as a surgical tool to disable endpoint protection. Disguised as an NVIDIA system component under the name ‘nvfsflt64.sys’ and registering itself as the ‘NvFsFilter’ service, the driver operates with kernel-level privileges.
According to technical analysis by LastPass, the driver maintains a hardcoded list of 145 distinct antivirus and endpoint detection and response (EDR) processes. It functions by calling the kernel function ObOpenObjectByPointer with AccessMode=KernelMode. This method is particularly insidious because it bypasses standard user-mode access checks. By requesting the kernel to treat the process-termination request as a native system command, the driver effectively neutralizes Protected Process Light (PPL) mechanisms—the very safeguards that security vendors implement to prevent even administrative users from tampering with their software.
The driver’s legitimacy is bolstered by the fact that it carries a valid digital signature from the Microsoft Windows Hardware Compatibility Publisher chain. While the driver is not currently listed on Microsoft’s official vulnerable driver blocklist, its existence underscores a growing crisis in software supply chain security: the abuse of legitimate code-signing infrastructure to validate malicious tools. Beyond its role as an EDR killer, the driver includes dormant functionality for traffic manipulation, port redirection, and file hiding, suggesting that the threat actors behind Rapuncel may be preparing for more complex, multi-stage intrusions in the future.
Rapuncel: Data Exfiltration and Persistence
Once the EDR and antivirus agents are effectively silenced, the Rapuncel infostealer executes its primary mission: the theft of sensitive user data. Rapuncel is designed to scrape credentials, session cookies, and browser data from all major web browsers, including Google Chrome and Microsoft Edge.
To overcome Google’s "app-bound encryption"—a security feature designed to prevent unauthorized processes from decrypting browser data—Rapuncel injects a specialized helper DLL into the browser process. This allows the malware to invoke its own "Elevation Service," effectively bypassing the security boundary intended to protect stored passwords.
The collected data is compressed and transmitted to an external command-and-control (C2) server, identified as 2.26.126[.]50, via raw TCP using an HTTP-formatted request. To ensure continued access, the malware establishes persistence by installing itself as a Windows service. This ensures that the infostealer re-initializes upon every reboot, and if any security software attempts to restart, the kernel driver is already in place to terminate the process immediately. Researchers suggest that Rapuncel is a refined iteration of the BoryptGrab infostealer, utilizing the Cruciferra PUROSANGUE crypter to keep its code obfuscated from static analysis.
Chronology and Broader Implications
The identification of this campaign marks a critical point in the ongoing struggle between developers and malicious actors. The timeline of the campaign indicates a high level of preparation, with the attackers likely spending weeks or months optimizing the SEO of their repositories to ensure maximum visibility.
Historically, this campaign mirrors the evolution of "malvertising" and repository poisoning, but the inclusion of a signed kernel driver elevates the threat profile significantly. Previous campaigns often relied on user error—tricking a user into disabling their own security. In this instance, the malware proactively disables the security for the user, removing the human element from the equation once the initial download is triggered.
Security experts note that the use of legitimate Microsoft-signed binaries and drivers creates a "trust deficit." When an organization’s security software is killed by a driver that bears a valid Microsoft signature, the operating system does not flag the activity as an intrusion. This effectively blinds the security operations center (SOC) until after the data has been exfiltrated.
Recommendations for Mitigation and Response
The collaboration between LastPass and Delphos Labs provides a necessary warning for both individual users and enterprise IT administrators. The implications of this campaign are far-reaching:
- Software Source Verification: Users must strictly limit their software downloads to official company websites or verified package managers. GitHub repositories, while useful for open-source development, are increasingly being weaponized to distribute malware.
- Search Engine Vigilance: Users are strongly advised to ignore "sponsored" or "promoted" results in search engines when looking for software. These results are frequently the first to be abused by malicious actors.
- Endpoint Hardening: Organizations should implement strict application control policies that prevent the execution of unsigned or suspicious binaries. Additionally, monitoring for the loading of unusual kernel drivers—specifically those that mirror common hardware names like "nvfsflt64.sys"—is essential.
- Security Software Updates: As threat actors continue to exploit signed drivers, Microsoft and security vendors are working to expand the blocklist of compromised signatures. Keeping EDR and OS platforms fully patched is the only way to ensure that known malicious drivers are effectively blocked from loading.
The Rapuncel campaign serves as a sobering reminder that the "trust" model of the internet is under constant assault. By weaponizing the tools that developers and users depend on for productivity, attackers are successfully bypassing traditional security layers. As the digital landscape continues to rely on automated search and repository-based software distribution, the responsibility falls on both the platforms (like GitHub and search engines) to better police their ecosystems, and on end-users to adopt a "zero-trust" approach toward any software downloaded from an unofficial source. The sophistication of this campaign suggests that as long as the rewards for credential theft remain high, the use of signed, kernel-level tools to neutralize defense will remain a cornerstone of modern cyber-attack strategies.
