Fake LastPass GitHub Repos Push a Kernel-Level Stealer
Security / news
Fake LastPass GitHub Repos Push a Kernel-Level Stealer
The Rapuncel campaign disables 145 antivirus products with a driver signed through Microsoft's own hardware-compatibility program, LastPass and Delphos Labs found.
A Windows user who searches for "LastPass Authenticator download" and lands on a fraudulent GitHub page gets a copy of a legitimate Microsoft debugging tool, renamed and repurposed to sideload a malicious DLL, which loads a kernel driver capable of disabling 145 antivirus and endpoint-detection processes before the Rapuncel infostealer harvests passwords, cryptocurrency wallets and session tokens. LastPass's Threat Intelligence, Mitigation and Escalation team and researchers at Delphos Labs, the malware-analysis firm co-founded by Caleb Fenton, its co-founder and chief technology officer, published their findings Sept. 17, tracing the operation to a fake GitHub organization, github.com/LastPass-Authenticator, that LastPass first identified Aug. 13.
The same distribution kit, hosted on a domain LastPass calls albinofennel.com, impersonated at least 40 companies, LastPass among them, using SEO-optimized fake pages designed to rank for each company's own download searches. LastPass said it reported the driver to Microsoft's Security Response Center on Aug. 19, and confirmed the redirect infrastructure was still being actively maintained as late as Aug. 27 through Sept. 10, the period its report covers.
How the fake GitHub repos work
Victims download a ZIP archive padded to roughly 148 megabytes, large enough to slip past some automated scanners. Inside is an installer that is actually vsdbg.exe, Microsoft's own Visual Studio CoreCLR debugger, renamed to sideload a malicious vsdbg.dll. That DLL deploys the Rapuncel infostealer along with a kernel driver, Alinubx.sys, disguised as an NVIDIA file-system filter driver named nvfsflt64.sys.
The driver that disables 145 security tools
Alinubx.sys carries 145 hardcoded antivirus and endpoint-detection-and-response process names and terminates them from kernel mode, according to LastPass's report. It bypasses Windows's Protected Process Light safeguards by calling ZwTerminateProcess after opening a target process with kernel-mode access, rather than tampering with the process's protection flags directly. LastPass said the driver was derived from CcProtect.sys, made by Henan Dafeng Software Co., and is signed through Microsoft's Windows Hardware Compatibility Publisher chain, the same program that vouches for legitimate hardware drivers. As of Aug. 20, the file had zero detections on VirusTotal, LastPass said, and it does not appear on Microsoft's vulnerable-driver blocklist.
| Date (2026) | Event |
|---|---|
| Aug. 13 | LastPass identifies the fraudulent GitHub organization |
| Aug. 19 | Delphos Labs reports the driver to Microsoft's Security Response Center |
| Aug. 20 | Alinubx.sys shows zero detections on VirusTotal, per LastPass |
| Aug. 27-Sept. 10 | Redirect infrastructure confirmed still active |
| Sept. 17 | LastPass and Delphos Labs publish their joint report |
What the Rapuncel infostealer steals, and from where
Once the security tools are down, Rapuncel harvests credentials from more than 25 browsers and data from more than 30 cryptocurrency wallets, along with Discord, Steam and Telegram session tokens and the contents of Windows Credential Manager, LastPass said. It also searches infected machines for files containing terms like "password," "seed" and "recovery," captures screenshots, and sends everything to a dedicated exfiltration server at 2.26.126.50 over raw TCP rather than standard HTTPS. LastPass said no LastPass system, service or customer vault was involved in the campaign; the company's name was used only as bait.
What Microsoft has not done yet
Microsoft has not said whether it has revoked the certificate chain that signs Alinubx.sys, and as of LastPass's Sept. 17 report, the driver still was not listed on Microsoft's own vulnerable-driver blocklist, a month after Delphos Labs' Aug. 19 report to MSRC. That gap sits alongside a broader run of credential-theft reporting this quarter, including how AWS's Continuum system tests stolen credentials before automated attackers use them and how the ShinyHunters extortion network has built a business around data taken the same way Rapuncel collects it. LastPass has not said whether it sought a GitHub takedown of the fraudulent organization or the other 40 impersonated companies' fake pages.
Sources
More in Security
- 01LiteLLM's 9.9-Rated Chain Needs v1.83.14 to Close, and Two Dates for It DisagreeAn internal user with a default virtual key can reach proxy admin and then code execution; Obsidian dates the full fix April 25, The Hacker News says May 2.
- 02Hacktron Chained a libheif Overflow and an SSO Flaw to Reach OpenAI's MonorepoOpenAI fixed the OpenAI-side bug 14 hours after the July 25 report, paid $6,500, and on November 6 signed the same researchers for ongoing red-teaming.
- 03Google's LLMJacking Report Names the Cloud Log Events That Give Attackers AwayMandiant's November 2 write-up puts single-day fraud above $100,000, and its most useful pages are the audit-log calls to alert on in AWS, Azure and Google Cloud.
- 04Fireworks AI Says a Second Intrusion Reached Datasets and Model WeightsThe inference host's November 9 update contradicts its October 9 bulletin, and Notion has switched off its Insights feature after AI chat transcripts were caught up.