New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools
A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.
Researchers from LastPass and Delphos Labs uncovered the Rapuncel infostealer campaign, which abuses a legitimate Microsoft-signed kernel driver to terminate security software. Attackers used fake GitHub repositories impersonating LastPass and other companies to distribute the malware. Once installed, Rapuncel disables 145 security processes using a kernel driver (Alinubx.sys) signed by the Microsoft Windows Hardware Compatibility Publisher, then steals sensitive data from browsers, wallets, and system storage. The driver was linked to Henan Dafeng Software and was not on Microsoft's vulnerable driver blocklist.
- A new infostealer, Rapuncel, uses a Microsoft-signed kernel driver to disable 145 antivirus and EDR processes.
- Attackers impersonated LastPass via fraudulent GitHub repositories to distribute the malware.
- The campaign steals browser passwords, cryptocurrency wallets, chat tokens, and system credentials.
- The malicious driver, a renamed version of CcProtect.sys, bypasses Protected Process Light protections.
- ATT&CK
- T1036.005 Match Legitimate Name or LocationT1574.002 DLL Side-LoadingT1014 RootkitT1555.003 Credentials from Web BrowsersT1071.001 Web Protocols
- Tags
- credential-theftdll-side-loadingedr-bypassgithubinfostealermalware-as-a-servicerapuncelsigned-driver
- Vendors
- MicrosoftGitHubCloudflare
- Products
- GitHubCloudflare
- Malware
- RapuncelAlinubx.sys
- Victims
- LastPass
- Organizations
- LastPassDelphos LabsHenan Dafeng Software
- Countries
- China
From the original article
2 min read at gbhackers.com
A newly identified information-stealing campaign, tracked as Rapuncel, is exploiting a Microsoft-attested kernel driver to terminate up to 145 antivirus (AV) and endpoint detection and response (EDR) processes. This allows attackers to steal browser credentials, cryptocurrency wallet data, chat tokens, and Windows credentials.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.