Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Researchers uncovered a malware campaign that used a Microsoft-attested Windows kernel driver to turn off 145 antivirus and endpoint security processes, then stole passwords, cryptocurrency wallet data, browser sessions, and other sensitive information.

LastPass Threat Intelligence, Mitigation, and Escalation team, working with Delphos Labs, discovered the operation after attackers impersonated LastPass Authenticator through fraudulent GitHub pages.

The researchers track the information-stealing malware as Rapuncel. The campaign did not compromise LastPass systems, services, or customer vaults. Instead, attackers abused the LastPass name to make fake download pages appear legitimate in search results.

Victims searching for “LastPass Authenticator download” could find a fake GitHub organization designed to resemble an official product page. The page included LastPass branding, SEO-focused descriptions, and a download button.

Clicking the button redirected visitors through several GitHub Pages sites before reaching attacker-controlled infrastructure. The operators used hidden redirect GitHub pages and a Cloudflare-protected traffic layer to change payload servers without updating the public lure pages.

The final payload arrived as a large ZIP archive, sometimes larger than 100 MB. Researchers said the oversized archives contained junk files intended to exceed automated sandbox and scanning limits.

Microsoft-Signed Driver Enables Security Bypass

Inside the ZIP file, attackers included a renamed Microsoft debugging executable, vsdbg.exe, alongside a malicious vsdbg.dll. Windows loaded the malicious DLL through DLL side-loading, allowing the attackers’ loader to run under the appearance of a legitimate Microsoft component.

After gaining elevated privileges, the malware deployed a kernel driver named Alinubx.sys, saved as nvfsflt64.sys and registered as the “NVIDIA File System Filter Driver.”

The driver carried a Microsoft Windows Hardware Compatibility Publisher signature chain. That signature helped the malicious component appear trusted to Windows and security controls, despite its ability to kill security software.

The driver contained 145 hardcoded process names associated with antivirus and endpoint detection and response products. It used a kernel-level process termination mechanism to stop the targeted tools, including products protected by Windows Protected Process Light technology.

Researchers linked the driver to the CnCrypt or CcProtect driver line associated with Henan Dafeng Software. The attackers appear to have renamed the driver while retaining its dangerous process-killing capability.

The driver was not listed in Microsoft’s vulnerable driver blocklist when researchers checked it. Its clean or near-clean detection history also allowed it to evade signature-based defenses.

After it disabled endpoint tools, the Rapuncel stealer collected saved browser passwords from more than 25 browsers. It also targeted Chrome and Edge app-bound encryption through browser-process injection, allowing it to request password decryption from inside the browser process.

The malware also collected cryptocurrency wallet files, Discord tokens, Steam session data, Telegram information, Windows Credential Manager data, screenshots, and documents containing terms such as “password,” “seed,” “wallet,” and “recovery.”

Collected information was compressed into a ZIP file and sent to the reported command-and-control endpoint at 2.26.126[.]50.

According to a LastPass Threat Intelligence report, security teams should investigate systems showing the creation of the NvFsFilter service or writes to C:\Windows\System32\drivers\nvfsflt64.sys. Other key artifacts include \.\Alinubx, Alinubx.ccf, ProtectR3.dll, and Henan Dafeng Software in the driver-signing metadata.

IOC Type	Indicator	Description
SHA-256	611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61	Alinubx.sys malicious kernel driver
SHA-256	aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd	Rapuncel credential-stealing payload
Domain	albinofennel[.]com	Primary payload server
Domain	hanselarinmusky[.]com	Secondary payload server
GitHub	github[.]com/LastPass-Authenticator	Fake LastPass Authenticator repository
GitHub Pages	lastpass-authenticator[.]github[.]io	Fake download portal
IP	2.26.126[.]50	Rapuncel data-exfiltration server
File Path	C:\Windows\System32\drivers\nvfsflt64.sys	Renamed malicious driver
Driver Service	NvFsFilter	Malicious driver service
Device Path	\\.\Alinubx	Malicious driver interface
File	ProtectR3.dll	Rootkit helper
File	vsdbg.dll	Malicious loader
File	browser_decryption.log	Credential-stealing artifact
Signing Metadata	Henan Dafeng Software Co., Ltd.	Related driver-signing identity

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Organizations should also monitor for renamed vsdbg.exe processes launching unusual child processes, kernel driver loads followed by mass termination of security tools, and large ZIP downloads from suspicious GitHub Pages lures.

Users who executed the fake installer should treat all credentials stored on the affected system as compromised. Change passwords, wallet credentials, browser sessions, and application tokens from a separate, known-clean device.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC