AI-generated editorial illustration; not a documentary photograph.
An active malware campaign is using search-optimized GitHub repositories that impersonate LastPass and at least 39 other companies to infect Windows systems with a previously undocumented information stealer called Rapuncel. LastPass and Delphos Labs uncovered the operation, according to BleepingComputer.
The campaign also deploys Alinubx.sys, a kernel driver configured to terminate processes associated with 145 antivirus and endpoint detection and response products. The driver used in the campaign is signed through Microsoft's Windows Hardware Compatibility Publisher chain and is not currently included in Microsoft's vulnerable driver blocklist.
Search Results Lead to Fake Downloads
Victims encounter the repositories while searching for LastPass Authenticator or other popular software. Download buttons initiate several redirects before delivering ZIP archives from separate payload servers. The archives can be inflated to as much as 148MB, a technique intended to hinder security scanning.
A Legitimate Debugger Loads the Malware
Inside the archive, attackers use a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger, vsdbg.exe, to sideload a malicious DLL. The installer then places Rapuncel and Alinubx.sys on the system. The driver is disguised as an NVIDIA component named nvfsflt64.sys and registers itself as the NvFsFilter service.
Researchers said the driver obtains kernel-level access to targeted processes and can bypass protections used by some security products. They also identified capabilities for hiding files and registry entries, injecting DLLs, intercepting processes and drivers, and manipulating network traffic, although those functions did not appear active in this campaign.
Rapuncel Targets Credentials and Wallets
After security tools are stopped, Rapuncel collects credentials from 25 browsers, data from 30 cryptocurrency wallets, Windows Credential Manager contents, and sessions for Discord, Steam, and Telegram. It also searches for documents whose names reference passwords, seed phrases, wallets or recovery, captures every connected display, and gathers system details.
The malware uses DLL injection and its own Elevation Service to work around app-bound encryption in Chrome, Edge and related browsers. Stolen information is compressed and sent to an external endpoint over raw TCP using an HTTP-formatted request.
Persistence Raises Recovery Risk
Rapuncel installs a Windows service to survive reboots. When the machine restarts, reactivated security products can be terminated again before the stealer runs. LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a BoryptGrab variant and found that its loader was built with the Cruciferra PUROSANGUE crypter.
The researchers advise obtaining software directly from official websites, avoiding questionable GitHub repositories, and skipping or blocking promoted Google Search results.
Source: Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
SIGNAL TITANS
Leave a Reply