Hackers Use Microsoft-Signed Driver to Disable Security Tools and Steal Credentials
A new malware campaign, dubbed Rapuncel, employs a Microsoft-signed kernel driver to disable over 145 security tools before stealing sensitive user data.
Researchers have uncovered a sophisticated malware operation that leverages a Microsoft-signed Windows kernel driver to disable a wide array of security software, paving the way for extensive data theft. The information-stealing malware, tracked as Rapuncel, was distributed through fake LastPass Authenticator download pages hosted on GitHub, designed to lure unsuspecting victims searching for legitimate software.
The attackers meticulously crafted these fraudulent pages to mimic official LastPass branding and optimize them for search engine results. When a user clicked the download button, they were redirected through a series of GitHub Pages sites before ultimately landing on attacker-controlled infrastructure. This multi-stage redirection, coupled with a Cloudflare-protected traffic layer, allowed the operators to change payload servers without altering the public-facing lure pages, adding a layer of obfuscation.
Upon downloading the payload, victims received a large ZIP archive, often exceeding 100 MB. This oversized archive contained junk files intended to overwhelm automated sandbox analysis and security scanning tools. Inside, attackers included a renamed Microsoft debugging executable, vsdbg.exe, alongside a malicious vsdbg.dll. By exploiting DLL side-loading, the malware could execute under the guise of a legitimate Microsoft component, gaining elevated privileges on the compromised system.
With elevated privileges, the malware deployed a kernel driver named Alinubx.sys, which was disguised as nvfsflt64.sys and registered as the "NVIDIA File System Filter Driver." Crucially, this driver possessed a valid Microsoft Windows Hardware Compatibility Publisher signature. This signature lent it an air of legitimacy, allowing it to bypass many security controls and operate undetected by Windows' trust mechanisms.
The malicious driver contained a hardcoded list of 145 process names belonging to various antivirus and endpoint detection and response (EDR) products. It then utilized a kernel-level process termination mechanism to forcibly shut down these security tools, even those protected by Windows' Protected Process Light technology. Researchers have linked this driver to the CnCrypt or CcProtect driver family, known for its potent process-killing capabilities.
Once endpoint defenses were neutralized, the Rapuncel stealer commenced its data exfiltration. It targeted saved browser passwords from over 25 different browsers, and also employed browser-process injection to steal credentials from Chrome and Edge. Beyond browser data, the malware pilfered cryptocurrency wallet files, Discord tokens, Steam session data, Telegram information, Windows Credential Manager data, and captured screenshots. It also searched for documents containing sensitive keywords like "password," "seed," "wallet," and "recovery."
All collected sensitive information was compressed into a ZIP archive and exfiltrated to a command-and-control server located at 2.26.126[.]50. Security teams are advised to monitor for specific indicators of compromise, including the creation of the NvFsFilter service, writes to the C:\Windows\System32\drivers\nvfsflt64.sys file path, and the presence of related artifacts like Alinubx.ccf and ProtectR3.dll. Organizations whose users may have executed the fake installer should treat all credentials on affected systems as compromised and immediately change passwords and tokens from a separate, trusted device.
This new report from LastPass details a sophisticated campaign that impersonates over 40 companies, including LastPass itself, to distribute a kernel-level EDR killer and the 'Rapuncel' infostealer. The malware leverages a Microsoft-attested driver to disable 145 security products and steal credentials from browsers, wallets, and other sensitive applications, with evidence suggesting a connection to the BoryptGrab stealer family.