Fake LastPass GitHub Repos Push a Kernel-Level Stealer
Security / news
Fake LastPass GitHub Repos Push a Kernel-Level Stealer
The Rapuncel campaign disables 145 antivirus products with a driver signed through Microsoft's own hardware-compatibility program, LastPass and Delphos Labs found.
A Windows user who searches for "LastPass Authenticator download" and lands on a fraudulent GitHub page gets a copy of a legitimate Microsoft debugging tool, renamed and repurposed to sideload a malicious DLL, which loads a kernel driver capable of disabling 145 antivirus and endpoint-detection processes before the Rapuncel infostealer harvests passwords, cryptocurrency wallets and session tokens. LastPass's Threat Intelligence, Mitigation and Escalation team and researchers at Delphos Labs, the malware-analysis firm co-founded by Caleb Fenton, its co-founder and chief technology officer, published their findings Sept. 17, tracing the operation to a fake GitHub organization, github.com/LastPass-Authenticator, that LastPass first identified Aug. 13.
The same distribution kit, hosted on a domain LastPass calls albinofennel.com, impersonated at least 40 companies, LastPass among them, using SEO-optimized fake pages designed to rank for each company's own download searches. LastPass said it reported the driver to Microsoft's Security Response Center on Aug. 19, and confirmed the redirect infrastructure was still being actively maintained as late as Aug. 27 through Sept. 10, the period its report covers.
How the fake GitHub repos work
Victims download a ZIP archive padded to roughly 148 megabytes, large enough to slip past some automated scanners. Inside is an installer that is actually vsdbg.exe, Microsoft's own Visual Studio CoreCLR debugger, renamed to sideload a malicious vsdbg.dll. That DLL deploys the Rapuncel infostealer along with a kernel driver, Alinubx.sys, disguised as an NVIDIA file-system filter driver named nvfsflt64.sys.
The driver that disables 145 security tools
Alinubx.sys carries 145 hardcoded antivirus and endpoint-detection-and-response process names and terminates them from kernel mode, according to LastPass's report. It bypasses Windows's Protected Process Light safeguards by calling ZwTerminateProcess after opening a target process with kernel-mode access, rather than tampering with the process's protection flags directly. LastPass said the driver was derived from CcProtect.sys, made by Henan Dafeng Software Co., and is signed through Microsoft's Windows Hardware Compatibility Publisher chain, the same program that vouches for legitimate hardware drivers. As of Aug. 20, the file had zero detections on VirusTotal, LastPass said, and it does not appear on Microsoft's vulnerable-driver blocklist.
| Date (2026) | Event |
|---|---|
| Aug. 13 | LastPass identifies the fraudulent GitHub organization |
| Aug. 19 | Delphos Labs reports the driver to Microsoft's Security Response Center |
| Aug. 20 | Alinubx.sys shows zero detections on VirusTotal, per LastPass |
| Aug. 27-Sept. 10 | Redirect infrastructure confirmed still active |
| Sept. 17 | LastPass and Delphos Labs publish their joint report |
What the Rapuncel infostealer steals, and from where
Once the security tools are down, Rapuncel harvests credentials from more than 25 browsers and data from more than 30 cryptocurrency wallets, along with Discord, Steam and Telegram session tokens and the contents of Windows Credential Manager, LastPass said. It also searches infected machines for files containing terms like "password," "seed" and "recovery," captures screenshots, and sends everything to a dedicated exfiltration server at 2.26.126.50 over raw TCP rather than standard HTTPS. LastPass said no LastPass system, service or customer vault was involved in the campaign; the company's name was used only as bait.
What Microsoft has not done yet
Microsoft has not said whether it has revoked the certificate chain that signs Alinubx.sys, and as of LastPass's Sept. 17 report, the driver still was not listed on Microsoft's own vulnerable-driver blocklist, a month after Delphos Labs' Aug. 19 report to MSRC. That gap sits alongside a broader run of credential-theft reporting this quarter, including how AWS's Continuum system tests stolen credentials before automated attackers use them and how the ShinyHunters extortion network has built a business around data taken the same way Rapuncel collects it. LastPass has not said whether it sought a GitHub takedown of the fraudulent organization or the other 40 impersonated companies' fake pages.
Sources
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.