Rapuncel: SEO fake LastPass Authenticator GitHub repos + signed EDR-killer driver (LastPass/Delphos)
BleepingComputer (18 September 2026), citing LastPass and Delphos Labs, reports an ongoing SEO/GitHub campaign that impersonates LastPass Authenticator and at least 39 other brands to deliver a previously undocumented infostealer they call Rapuncel. Victims searching for legitimate software land on fake GitHub repos; download buttons redirect to ZIP payloads (inflated up to ~148MB) containing a renamed legitimate Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) that sideloads malicious vsdbg.dll. The chain deploys Rapuncel plus Alinubx.sys, a Microsoft Hardware Compatibility Publisher-signed kernel driver (disguised as NVIDIA nvfsflt64.sys / NvFsFilter) that terminates a hardcoded list of 145 AV/EDR processes via ObOpenObjectByPointer(AccessMode=KernelMode), bypassing PPL. Rapuncel then steals credentials from 25 browsers (incl. Chrome app-bound encryption bypass via Elevation Service helper), 30 crypto wallets, Discord/Steam/Telegram sessions, Windows Credential Manager, password/seed/wallet-named documents, and screenshots; exfil to 2.26.126[.]50 over raw TCP; persists as a Windows service. LastPass/Delphos assess moderate confidence Rapuncel is a BoryptGrab variant; loader uses Cruciferra PUROSANGUE crypter. Driver not on Microsoft vulnerable-driver blocklist at time of report. Hygiene: download only from official sites; avoid promoted GitHub search results. Primary vendor write-up URL cited by BC (blog.lastpass.com …/lastpass-delphos-report-rapuncel-infostealer) returned HTTP 403 from fetchers this pass — wire used until vendor page reachable.
- Product
- Windows desktops (GitHub SEO lures → Rapuncel infostealer + Alinubx.sys EDR killer)
- Versions
- n/a (malware family / signed driver campaign; not a product CVE)
- Exploited in Australia?
- unknown
- Patch to
- Do not install from GitHub search/promoted results for Authenticators or AV tools; prefer vendor official download pages; check Microsoft vulnerable-driver blocklist updates for Alinubx.sys / NvFsFilter impostors; rotate browser and wallet credentials if exposure suspected.
Primary: BleepingComputer — Rapuncel / fake LastPass Authenticator GitHub (18 Sep 2026) · Vendor: LastPass/Delphos — Rapuncel report URL (403 from desk fetchers 19 Sep; confirm when reachable)