Microsoft-Signed Driver Kills 145 Antivirus Products: The…

An active malware campaign since August 13, 2026 impersonates LastPass and at least 39 other companies on SEO-optimized GitHub repositories to distribute the Rapuncel infostealer, armed with a Microsoft-signed kernel driver capable of terminating 145 EDR/AV processes and bypassing Protected Process Light.

{"main_topic":"malware","topics":["malware","infostealer","cybersec","microsoft","big-tech"]}

A malware campaign active since August 13, 2026 impersonates LastPass and at least 39 other companies on SEO-optimized GitHub repositories to distribute the Rapuncel infostealer, armed with a Microsoft-signed kernel driver capable of terminating 145 EDR/AV processes and bypassing Protected Process Light. LastPass and Delphos Labs documented the attack chain, demonstrating how the WHCP signature of a legitimate driver has become more effective than a zero-day exploit for neutralizing endpoint defenses.

Key Takeaways

The Rapuncel infostealer, discovered by LastPass and Delphos Labs, distributes via fake GitHub repositories that appear in organic searches for "LastPass Authenticator" and popular software.
A Microsoft-signed kernel driver, Alinubx.sys, masquerading as an NVIDIA component, terminates 145 antivirus/EDR processes by bypassing Protected Process Light through kernel-mode calls.
The infection chain employs ZIP files inflated to 148MB, multiple redirects, and DLL sideloading via a renamed copy of the Microsoft debugger vsdbg.exe.
Rapuncel harvests credentials from Discord, Steam, Telegram, and sensitive documents, then bypasses Chrome/Edge app-bound encryption for exfiltration to IP 2.26.126.50.

How the GitHub Trap Works

The attack chain begins through search engines. Users searching for "LastPass Authenticator" or other popular software find fraudulent GitHub repositories among the top organic results, optimized for SEO placement. The download page displays false claims such as "VirusTotal Approved" and "Secure Archive" to reassure even technically savvy victims.

Download buttons trigger a series of redirects leading to payload delivery servers. The distributed ZIP archives are inflated to 148MB, a deliberate technique to evade automated scanners with size limits. Inside sits an installer that is a legitimate copy of vsdbg.exe, the Microsoft Visual Studio CoreCLR debugger, renamed and configured for sideloading a malicious DLL (vsdbg.dll).

Alinubx.sys: The "Certificate" That Kills EDRs

The most dangerous component of the campaign is Alinubx.sys, a kernel driver the source links to the CnCrypt/CcProtect family, known for bring-your-own-vulnerable-driver attacks. The file masquerades as the NVIDIA component "nvfsflt64.sys" and registers as the "NvFsFilter" service, but is signed through Microsoft's Windows Hardware Compatibility Publisher chain.

"The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time. It asks the kernel to open the process as kernel code, then kills it. That is why it can defeat Protected Process Light (PPL); the protection many security products rely on to survive an administrator."
— LastPass, via BleepingComputer

The driver contains a hardcoded list of 145 antivirus and EDR processes. The technical mechanism is precise: using ObOpenObjectByPointer with AccessMode=KernelMode, the driver bypasses SeAccessCheck by opening target processes as kernel code rather than user-mode code, then terminates them. This defeats Protected Process Light, the protective barrier many security products rely on to survive even a compromised administrator.

According to sources, Alinubx.sys does not appear on Microsoft's vulnerable driver blocklist as of the time of documentation. The driver possesses additional capabilities for file and registry hiding, DLL injection, driver/process interception, traffic manipulation, and port redirection, but these features were not activated in the observed campaign.

Rapuncel: Data Collection and Cryptographic Bypass

Once the driver has blinded the system to security tools, the Rapuncel infostealer — assessed with moderate confidence as a variant of BoryptGrab with a loader built via the Cruciferra PUROSANGUE crypter — begins data collection. The malware extracts session credentials from Discord, Steam, and Telegram, along with documents whose names contain strings such as "password", "seed", "wallet", and "recovery".

To bypass Chrome and Edge app-bound encryption, which isolates sensitive browser data to the originating process, Rapuncel injects a helper DLL into the browser process and invokes its own Elevation Service. Stolen data is compressed and transmitted via HTTP request over raw TCP to the external endpoint 2.26.126.50.

Persistence is maintained by a Windows service that reactivates the infostealer on reboot, again killing previously neutralized security tools.

Why This Matters

The Rapuncel campaign exposes three structural weaknesses in the industry. First is the ongoing commoditization of Microsoft-signed EDR killers: a driver with valid WHCP certification that terminates 145 security products requires no zero-day vulnerability, only access to Redmond's hardware certification program. Second is the ineffectiveness of Microsoft's vulnerable driver blocklist, which fails to keep pace with rapidly evolving threats.

The third weakness concerns the abuse of code-hosting platforms as distribution vectors. SEO-optimized GitHub repositories exploit the trust developers place in the platform, making legitimate software indistinguishable from malicious code until execution.

The brief does not document specific remedial measures taken by Microsoft or GitHub, nor whether the Alinubx.sys driver has been revoked or added to the blocklist following the August 13, 2026 detection. The source does not specify the exact number of victims or the geographic scope of the campaign.

Frequently Asked Questions

Was LastPass breached? No. LastPass explicitly confirmed that its systems, services, and customer vaults were not compromised. The GitHub repositories were created by external threat actors impersonating the brand.

Why isn't the Microsoft-signed driver blocked? The Windows Hardware Compatibility Publisher signature is valid; the driver does not appear on Microsoft's vulnerable driver blocklist. This falls under the BYOVD (bring-your-own-vulnerable-driver) category, where a legitimate component with a valid signature is abused for malicious purposes.

What makes this campaign different from other infostealer distributions? The combination of three elements rarely seen together: SEO poisoning on GitHub, a kernel driver signed with active PPL termination capability, and browser app-bound encryption bypass. The entire chain aims to make compromise irreversible without kernel-level intervention.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter