Rapuncel (Malware): news timeline & CVEs

Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

GitHub-based LastPass impersonation distributed 'Rapuncel' infostealer using a signed driver to kill 145 security tools.

Attackers impersonated LastPass on GitHub, distributing a fake authenticator that deployed an infostealer named 'Rapuncel'. The campaign used a Microsoft-signed kernel driver to disable 145 antivirus and EDR products before stealing credentials from browsers, crypto wallets, and other applications. LastPass and Delphos Labs identified this as a multi-stage malware-as-a-service operation that impersonated at least 40 different companies, with the driver being a renamed version of the known Chinese disk-encryption driver CcProtect.sys.

Security AffairsSep 23, 08:25 UTC · 4d agoMalware in the wild 5 sources

AWS Strands Agents Team Releases Strands Harness: An Open-Source Agent Harness With 28% Lower Token Cost at Comparable Accuracy

AWS Strands Agents Team releases a general-purpose agent harness with 28% lower cost at comparable accuracy across 6 benchmarks.

AWS Strands Agents Team releases a general-purpose agent harness (Strands Harness) targeting agent efficiency gaps, reporting 28% lower cost across 6 benchmarks with near-equal accuracy.

MarkTechPostSep 21, 21:42 UTC · 5d agoOther

Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer

Fake LastPass installers triggered an infostealer malware campaign targeting at least 40 organizations, exploiting kernel-level EDR killers and stealing passwords and wallet data.

Fake LastPass installers triggered an infostealer malware campaign targeting at least 40 organizations, deploying kernel-level EDR killers and a stealer that steals passwords and wallet data.

SecurityWeekupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 15:46 UTC · 5d agoOther in the wild 5 sources

New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.

Researchers from LastPass and Delphos Labs uncovered the Rapuncel infostealer campaign, which abuses a legitimate Microsoft-signed kernel driver to terminate security software. Attackers used fake GitHub repositories impersonating LastPass and other companies to distribute the malware. Once installed, Rapuncel disables 145 security processes using a kernel driver (Alinubx.sys) signed by the Microsoft Windows Hardware Compatibility Publisher, then steals sensitive data from browsers, wallets, and system storage. The driver was linked to Henan Dafeng Software and was not on Microsoft's vulnerable driver blocklist.

GBHackersupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 11:36 UTC · 5d agoMalware in the wild 5 sources1

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.

A malware campaign tracked as Rapuncel used a Microsoft-signed kernel driver (Alinubx.sys) to disable 145 antivirus and EDR processes before stealing passwords and sensitive data. Attackers created fake GitHub repositories impersonating LastPass Authenticator to distribute the malware via large ZIP archives. The signed driver, a renamed version of CcProtect.sys from Henan Dafeng Software, was not on Microsoft's vulnerable driver blocklist and allowed the malware to bypass security protections. The stolen data included browser credentials, cryptocurrency wallets, and chat tokens, which were exfiltrated to a C2 server.

Cyber Security Newsupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 11:30 UTC · 5d agoMalware in the wild 5 sources

Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer

Fake LastPass Authenticator GitHub repos spread new Rapuncel infostealer alongside a Microsoft-signed kernel driver that kills 145 antivirus and EDR products.

LastPass and Delphos Labs uncovered an ongoing campaign using SEO-optimized GitHub repositories impersonating LastPass and at least 39 other companies to deliver the previously undocumented Rapuncel infostealer. Oversized ZIPs up to 148MB carry vsdbg.exe sideloading a malicious vsdbg.dll, which deploys Rapuncel and the Alinubx.sys kernel driver (signed via Microsoft's Windows Hardware Compatibility Publisher chain) that terminates 145 AV/EDR processes and bypasses Protected Process Light via kernel-mode handle opens. Rapuncel steals credentials from 25 browsers, 30 cryptocurrency wallets, Discord, Steam, and Telegram sessions, bypasses Chrome's app-bound encryption via DLL injection, and exfiltrates data to 2.26.126[.]50 over raw TCP; researchers assess with moderate confidence it is a BoryptGrab variant.

BleepingComputerSep 18, 15:19 UTC · 8d agoMalware in the wild

Rapuncel

Timeline6 articles

Appears with