Rapuncel ships a Microsoft-attested kernel driver built to terminate 145 security products
LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
The Watch · Security desk
What happened
- LastPass found a fake LastPass Authenticator on GitHub on August 13 and tied it to a campaign that had been running for several months, with no compromise of its own systems.
- SEO put the fraudulent GitHub download page among the top results for people searching for the real application, and a second page offered a fake macOS version.
- The payload, Rapuncel, installs a kernel driver disguised as an NVIDIA graphics component and designed to terminate 145 antivirus and endpoint security products.
- With detection down, it collects saved passwords from 25 browsers, cryptocurrency files from 30 wallet applications, Discord, Steam and Telegram data, and the Windows credential store.
- Delivery ran through multiple GitHub pages into a Cloudflare-fronted server whose final destination the operator could repoint at will.
Why it matters
- What's now possible capability An attested driver that kills 145 products makes endpoint detection something an attacker removes on arrival, so a quiet console on a suspect host is not evidence the host is clean.
- What it costs cost Cleanup moves out of the quarantine-the-sample workflow and into host rebuilds, and that bill lands on whoever owns the endpoint fleet rather than on the security team that found it.
- Who has to decide decision Letting users install software from GitHub-hosted release pages is now an admission-control decision, because search ranking was the distribution channel here.
- What it sets up precedent The hiding and injection code shipped in the build but sat unconfigured, so that capability is already staged and a later iteration can enable it without new development.
Next story · Security · Oct 8
FakeGit rewrote more than 13,000 GitHub repos in 34 hours to spread SmartLoaderConfirmed2 publishers
The privilege escalation uses features already present in Windows [9], and the remedy LastPass describes is physical removal of the driver, not a patch. The company did not say how the operators obtained Microsoft attestation for that driver, or whether the signature has since been revoked [19].
LastPass said: "The malware installs itself as a Windows service that starts automatically every time the computer boots. It then loops continuously: checking for security products, killing any that have restarted, and re-running the stealer. The machine may remain fully under the attacker's control until the kernel driver is physically removed" [13]. The same driver carries code to hide itself and to inject a helper into every running process, and the build LastPass examined lacked the configuration to switch either on [12].
The executable inside the archive is Microsoft's own debugging tool under a different name, with the attacker's code sitting in the companion DLL it loads; the archive also holds a malicious file and junk [8]. Working with Delphos, LastPass tied that DLL to Cruciferra, a crypter service Proofpoint documented recently [16]. The DLL was probably built with a Cruciferra package called PUROSANGUE, which has produced other side-loaded DLLs containing EDR and AV kill code [17].
The Cloudflare-fronted server was still answering with a JavaScript redirect on September 10, 28 days after the August 13 discovery [10][18]. LastPass said "its content had changed between August 27 and September 10, confirming active ongoing maintenance" [11].
BoryptGrab, an infostealer pushed through roughly 100 GitHub repositories earlier this year, overlaps with this one at several points [14]. "Delphos compared the Rapuncel stealer payload directly against Trend Micro's documented BoryptGrab samples. The two families are not byte-identical; however, the behavioral and artifact-level overlap is strong. Delphos assesses Rapuncel is a BoryptGrab-related variant or sibling build," LastPass said [15].
What to watch
- Whether Microsoft revokes the attestation signature and the driver hash reaches Windows blocklists.
- Whether a later build ships with the hiding and process-injection features configured and active.
- Whether the Cloudflare-fronted server is repointed again after the September 10 observation, and whether the GitHub pages come down.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 27%
- Operator
- Operator 64%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The attackers impersonated at least 40 organizations to push a Microsoft-attested kernel driver designed to terminate 145 security tools and open the door to an infostealer called Rapuncel.
- [2]
A fake LastPass Authenticator distributed via GitHub led LastPass to discover a broad impersonation campaign delivering infostealer malware.
- [3]
The fake LastPass lure was discovered on August 13, represents opportunistic brand spoofing with no internal LastPass systems compromised, and forms part of a campaign active for several months.
- [4]
Once the security tools are shut down, the malware looks for saved passwords in 25 browsers, cryptocurrency files of 30 wallet applications, Discord tokens, Steam tokens, Telegram data, the Windows credential store, and all documents containing credential and wallet keywords.
- [5]
Using SEO optimization, the attackers' GitHub page serving the fraudulent LastPass Authenticator appeared among the top results for users searching for the legitimate application; another page offered a fake macOS LastPass application.
- [6]
Rapuncel takes a screenshot of every connected monitor and captures a detailed profile of the system.
- [7]
The attackers used a hidden routing chain relying on multiple GitHub pages and a Cloudflare-fronted server to direct victims to a final destination the operator could change dynamically.
- [8]
The victim reached a download page serving an archive containing a fake installer, a malicious file, and junk; the installer was a renamed version of Microsoft's own debugging tool that loaded a companion DLL containing the attacker's code.
- [9]
Rapuncel attempts to achieve System privileges via built-in Windows features and installs a kernel driver posing as an NVIDIA graphics component designed to terminate 145 antivirus and endpoint security products.
- [10]
The server was still active and serving a JavaScript redirect as of September 10.
- [11]
"its content had changed between August 27 and September 10, confirming active ongoing maintenance"
- [12]
The driver contains code to hide itself and inject a helper into every running process, but the observed iteration lacked the necessary configuration and did not activate those features.
- [13]
"The malware installs itself as a Windows service that starts automatically every time the computer boots. It then loops continuously: checking for security products, killing any that have restarted, and re-running the stealer. The machine may remain fully under the attacker's control until the kernel driver is physically removed"
- [14]
The campaign shows several overlaps with BoryptGrab, an information stealer distributed through roughly 100 GitHub repositories earlier this year.
- [15]
"Delphos compared the Rapuncel stealer payload directly against Trend Micro's documented BoryptGrab samples. The two families are not byte-identical; however, the behavioral and artifact-level overlap is strong. Delphos assesses Rapuncel is a BoryptGrab-related variant or sibling build"
- [16]
The investigation, performed in collaboration with Delphos, revealed a connection with Cruciferra, a crypter service recently detailed by Proofpoint, through the malicious DLL loaded during the infection chain.
- [17]
The DLL was likely produced using the Cruciferra package called PUROSANGUE, which was previously used to create other side-loaded DLLs that contained EDR/AV-killing code.
- [18]
The redirect server was observed operating for 28 days between the August 13 discovery and the September 10 check.
- [19]
The LastPass report does not state how the kernel driver obtained Microsoft attestation, or whether the attestation signature has been revoked.
Sources
4 independent publishers whose own reporting we read for this story.
- scworld.comNew Rapuncel infostealer campaign uses fake GitHub repos to disable antivirus
1 article · September 21, 2026
- securityaffairs.comFake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools
1 article · September 23, 2026
- securityweek.comFake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer
1 article · September 21, 2026
- thehackernews.comFake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
1 article · September 21, 2026
Topics and entities
Topics
- DLL side-loading into trusted agents
- Infostealer Malware
- Driver signing and blocklists
- Brand Impersonation
- Bring Your Own Vulnerable Driver