GitHub malware campaign weaponizes open-source hosting to deliver Rapuncel

The campaign’s core question—how attackers turn a trusted code-hosting platform into a delivery vector—gets answered in the first paragraph. Researchers at LastPass and Delphos Labs reported that on September 18, 2026 a set of GitHub repositories masquerading as the LastPass Authenticator and other popular utilities were used to distribute a Microsoft-signed kernel driver and the previously undocumented Rapuncel infostealer. The malicious repos rank highly for common search terms, lure users with a prominent Download button, and serve a ZIP archive that installs both components. The findings were published on BleepingComputer"Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer".

Attack chain: from search query to kernel-mode kill

Victims start by searching for “LastPass Authenticator” or similar tools. Because the fake repositories appear near the top of search results, users click the Download link and are redirected through several short URLs before receiving a ZIP file up to 148 MB in size. The large payload helps the archive evade many automated scanners that enforce strict file-size limits.

Inside the archive, a renamed copy of Microsoft’s legitimate Visual Studio CoreCLR Debugger executable (vsdbg.exe) loads a malicious DLL (vsdbg.dll). The DLL performs two critical actions:

  1. Deploy the Rapuncel infostealer – extracts the payload and writes it to disk.
  2. Install the Alinubx.sys kernel driver – disguised as an NVIDIA component (nvfsflt64.sys) and registered as the NvFsFilter service.

The driver’s primary function is to act as an EDR killer. It contains a hard-coded list of 145 security-product process names and terminates them by invoking ObOpenObjectByPointer with AccessMode=KernelMode. This bypasses user-mode checks and allows the driver to kill processes protected by Protected Process Light (PPL), a mechanism many vendors rely on to survive administrator-level attacks.

Rapuncel’s data-theft capabilities

After the driver clears the security landscape, Rapuncel begins harvesting data. It collects:

  • Credentials from 25 web browsers.
  • Private keys and seed phrases from 30 cryptocurrency wallets.
  • Session tokens for Discord, Steam, and Telegram.
  • Contents of the Windows Credential Manager.
  • Files whose names contain keywords such as "password," "seed," "wallet," or "recovery".
  • Screenshots from every connected monitor.
  • Detailed system information (CPU, OS version, installed software, etc.).

To defeat browser-level encryption, Rapuncel injects a helper DLL into each browser process and launches its own Elevation Service. Collected data is compressed and sent to a hard-coded IP address 2.26.126[.]50 via an HTTP-style request over raw TCP, bypassing TLS inspection.

The malware persists by creating a Windows service that restarts on reboot. If a security product is re-installed, the driver kills it again before Rapuncel can execute, creating a self-reinforcing kill-and-steal loop.

Why the driver evades Microsoft’s blocklist

The driver is signed with a legitimate Microsoft Windows Hardware Compatibility Publisher certificate. This signing chain places the driver outside the scope of Microsoft’s vulnerable-driver blocklist, giving it a veneer of trust and allowing it to load on systems that enforce driver-signing policies. Researchers also noted dormant capabilities—file and registry hiding, DLL injection, traffic manipulation, and port redirection—that were not activated in the observed campaign.

Implications for the software supply chain

The campaign challenges the assumption that open-source hosting platforms are inherently safe. GitHub’s public nature and reliance on search-engine indexing make it an attractive vector for search-engine poisoning. Attackers can create convincing replicas of popular projects, seed them with malicious releases, and rely on users’ habit of downloading the “latest version” without verifying provenance.

Original analysis: The incentive for threat actors is clear: low cost, high reach, and minimal technical barriers. By exploiting search rankings, they bypass traditional supply-chain defenses that focus on binary verification. The consequence is a shift in risk from the build pipeline to the discovery phase. Users who trust the first search result become the weakest link. To mitigate, organizations must extend verification beyond code signatures to include repository provenance and search-engine hygiene.

Actionable recommendations for developers and end-users

  • Verify repository ownership – check the organization’s GitHub profile, follower count, and commit history. Official vendors usually host releases under verified accounts or provide signed release assets.
  • Prefer official download portals – obtain installers directly from the vendor’s website or use package managers that enforce cryptographic verification (e.g., winget, apt, brew).
  • Block promoted search results – configure browser extensions or enterprise DNS filters to suppress top-ranking results for known-to-be-abused keywords.
  • Enforce kernel-mode code signing – enable strict driver signing policies and monitor for newly installed drivers that are not part of the known hardware catalog.
  • Deploy behavior-based EDR with kernel-level protection – solutions that monitor driver load events and process-termination attempts can detect the kill-and-steal pattern before the infostealer gains a foothold.

Market impact and regulatory outlook

While the campaign does not target cryptocurrency exchanges directly, the theft of wallet credentials and seed phrases poses a direct financial risk to individual investors. Enterprises that rely on GitHub for internal tooling distribution must reassess their software-supply-chain hygiene and consider implementing code-signing verification pipelines for all third-party binaries.

Regulators are expected to issue guidance on software-supply-chain transparency, mirroring recent EU directives on open-source component disclosure. In the interim, security teams should treat any GitHub-hosted binary that lacks a vendor signature as untrusted.

The technique mirrors earlier supply-chain attacks such as the Brevo ClickFix injection and the Gyazo server flaw, both of which exploited trusted platforms to reach a broad audience with minimal friction. Watch for the following developments:

  • Emergence of additional driver-based EDR killers – the signing method used here may be reused in future campaigns.
  • Changes to GitHub’s search ranking algorithm – any adjustments could affect the visibility of malicious repositories.
  • Vendor responses – monitor statements from Microsoft regarding driver signing policy updates and from LastPass on user-education campaigns.

Key takeaways

  • Fake GitHub repositories now deliver a Microsoft-signed kernel driver that disables 145 security products.
  • The Rapuncel infostealer extracts a wide range of credentials, including crypto wallets, and exfiltrates them via raw TCP.
  • Users must verify download sources, block promoted search results, and enforce strict driver signing policies to mitigate this emerging threat.

Explore more on this topic