Microsoft-Attested Driver Targeted: Rapuncel Malware Weaponizes Trust Chain

On August 13, 2026, LastPass discovered a GitHub page impersonating its authenticator to distribute malware. The campaign, active for months and still under maintenance as of September 10, extends beyond a single brand: according to the cited source, attackers impersonate at least 40 organizations and deploy an infostealer, Rapuncel, protected by a Microsoft-attested kernel driver designed to terminate 145 antivirus and EDR products. The novelty lies not only in the chain's sophistication but in its technically incomplete state: the observed iteration did not activate the driver's most aggressive features, suggesting the threat is still evolving.

The Infection Chain: From GitHub to the Windows Kernel

The campaign begins on search engines. The GitHub page was optimized to rank among top results, directing users into a multi-stage routing chain: multiple GitHub pages and Cloudflare-fronted servers with dynamic JavaScript redirects. According to the cited report, the final download is an archive containing a renamed installer of a legitimate Microsoft debugging tool.

Side-loading a malicious DLL triggers the next phase. The DLL, likely produced with the commercial crypter package Cruciferra PUROSANGUE, is linked to previous campaigns with EDR/AV-killing code. From here, the Rapuncel malware attempts escalation to System privileges via built-in Windows functionality.

The decisive step is the installation of a kernel driver posing as an NVIDIA graphics component. The driver is Microsoft-attested, meaning it passed through the legitimate Windows signing chain. This element is central: this is not an attestation bypass, but a functional abuse of it.

The Driver That Hasn't Triggered Yet: Technical Incompleteness and Evolutionary Risk

According to the cited source, the driver contains code to hide itself and inject a helper into every running process. However, the iteration observed during analysis lacked the necessary configuration: these capabilities did not activate. The dossier does not specify which configuration was missing, nor whether it involves registry keys, external files, or in-memory parameters.

This incompleteness is doubly significant. On one hand, it limits the documented impact of the observed campaign. On the other, it indicates operators possess capabilities not yet deployed: the driver is designed for more invasive operations than those detected. Active server maintenance between August 27 and September 10 — with modified content — reinforces the hypothesis of an operation under continuous update.

"The attackers impersonate at least 40 companies and disable 145 security products to deploy infostealer malware." — SecurityWeek reporting on LastPass

Rapuncel: Anatomy of a Cross-Platform Infostealer

Once system control is obtained, Rapuncel initiates broad, structured data collection. According to the cited source, the malware searches for passwords in 25 different browsers, files from 30 crypto wallet applications, Discord, Steam, and Telegram tokens, the Windows credential store, and documents containing keywords related to credentials and wallets.

The surveillance component is equally specific: Rapuncel captures screenshots of every connected monitor and builds a detailed profile of the system's hardware and software configuration. Persistence occurs via installation as a Windows service with automatic execution, in a continuous loop: verify EDR presence, terminate if detected, re-execute the stealer.

Delphos comparative analysis contrasted Rapuncel with BoryptGrab samples documented by Trend Micro. According to the cited report, the two are not byte-identical but show strong behavioral overlap; Delphos assesses Rapuncel as a variant or related build. The dossier does not clarify whether "Rapuncel" is a definitive or provisional designation.

What to Do Now

For organizations, the priority is verifying the presence of LastPass Authenticator installers downloaded from unofficial sources between August 13 and September 10, 2026. Indicators of compromise include: undocumented Windows services with automatic execution, processes taking periodic screenshots, and attempts to load drivers with NVIDIA component names on systems without compatible hardware.

The documented routing chain — search engine SEO, GitHub pages, Cloudflare-fronted servers with JavaScript redirects — suggests the primary vector is web-based social engineering, not automatic technical exploits. User training on risks of downloading from unverified repositories remains relevant.

For security teams, the Microsoft-attested driver represents a case of trust chain abuse rather than technical vulnerability. Available documentation does not indicate specific detection methods beyond post-infection behavioral analysis.

Frequently Asked Questions

Are password authenticators at general risk?

The brief documents no vulnerabilities in legitimate authenticators. The risk is specific to the observed impersonation campaign, which exploits LastPass brand recognition to induce downloads.

Is the kernel driver a Windows vulnerability?

No. The driver is Microsoft-attested, meaning legitimately signed. The observed iteration did not activate full capabilities, but the signature itself was not compromised.

What data did Rapuncel actually steal?

The dossier does not specify data actually exfiltrated. It documents collection capabilities — 25 browsers, 30 crypto wallets, messaging platform tokens — but not volume or confirmation of exfiltration.

Is the campaign still active?

As of September 10, 2026, the server was operational with content modified since August 27, indicating active maintenance. It is not documented whether distribution of the LastPass lure continued beyond that date.

Editorial Close

The Rapuncel campaign illustrates a structural tension in contemporary security: the trust chain that makes Windows operational can be redirected against those who implement it. The Microsoft-attested driver is not a bug but an abused feature; SEO is not an attack but a distribution channel; GitHub is not complicit but an impersonated platform.

That the observed iteration remained technically incomplete does not diminish the case's relevance. Rather, it indicates an operation in progress, with capabilities not yet deployed and operators still active at the time of documentation. For defenders, this means detection must anticipate not only what the malware has done, but what it is designed to do.