Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.
A malware campaign tracked as Rapuncel used a Microsoft-signed kernel driver (Alinubx.sys) to disable 145 antivirus and EDR processes before stealing passwords and sensitive data. Attackers created fake GitHub repositories impersonating LastPass Authenticator to distribute the malware via large ZIP archives. The signed driver, a renamed version of CcProtect.sys from Henan Dafeng Software, was not on Microsoft's vulnerable driver blocklist and allowed the malware to bypass security protections. The stolen data included browser credentials, cryptocurrency wallets, and chat tokens, which were exfiltrated to a C2 server.
- Attackers used a Microsoft-signed kernel driver to disable 145 security tools and steal passwords and cryptocurrency.
- The campaign impersonated LastPass Authenticator through fraudulent GitHub repositories.
- The Rapuncel malware steals data from 25+ browsers, crypto wallets, and chat applications.
- The malicious driver, Alinubx.sys, bypasses user-mode security checks using kernel-level process termination.
- ATT&CK
- T1036.005 Match Legitimate Name or LocationT1574.002 DLL Side-LoadingT1014 RootkitT1555.003 Credentials from Web BrowsersT1555 Credentials from Password Stores
- Vendors
- MicrosoftGitHubCloudflare
- Malware
- RapuncelAlinubx.sys
- Victims
- LastPass
- Organizations
- LastPassDelphos LabsHenan Dafeng Software
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | albinofennel.com | e850109decbfadd Rapuncel credential-stealing payload Domain albinofennel[.]com Primary payload server Domain hanselarinmusky[.]com Secon |
| domain | hanselarinmusky.com | oad Domain albinofennel[.]com Primary payload server Domain hanselarinmusky[.]com Secondary payload server GitHub github[.]com/LastPass-Aut |
| domain | lastpass-authenticator.github.io | ticator Fake LastPass Authenticator repository GitHub Pages lastpass-authenticator[.]github[.]io Fake download portal IP 2.26.126[.]50 Rapuncel data-exf |
| ipv4 | 2.26.126.50 | astpass-authenticator[.]github[.]io Fake download portal IP 2.26.126[.]50 Rapuncel data-exfiltration server File Path C:\Windows\Sy |
| sha256 | 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61 | er-signing metadata. IOC Type Indicator Description SHA-256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61 Alinubx.sys malicious kernel driver SHA-256 aefbc6e04320e9a |
| sha256 | aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd | eea3fdb6f7b5b61 Alinubx.sys malicious kernel driver SHA-256 aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd Rapuncel credential-stealing payload Domain albinofennel[.] |
From the original article
3 min read at cybersecuritynews.com
Researchers uncovered a malware campaign that used a Microsoft-attested Windows kernel driver to turn off 145 antivirus and endpoint security processes, then stole passwords, cryptocurrency wallet data, browser sessions, and other sensitive information.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.