"The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time," explains LastPass.
SEO-optimized GitHub repositories impersonating LastPass and 39 other companies
LastPass and Delphos Labs uncovered an active campaign that uses search engine optimization and fake GitHub repositories to impersonate legitimate software vendors — including the LastPass Authenticator brand and at least 39 other companies. Victims who search for LastPass Authenticator or other popular software and follow links to these repositories are presented with pages that mimic official downloads; clicking the displayed download buttons begins a chain of redirections that ends at attacker-controlled payload-delivery servers.
Attack chain: inflated ZIPs, vsdbg.exe sideload, and hidden payloads
The delivery mechanism is built to evade casual inspection and many automated scanners. Repositories push ZIP archives whose reported sizes are inflated to as much as 148MB. Inside the archive is an installer that includes a legitimate Microsoft component — the Visual Studio CoreCLR Debugger, vsdbg.exe — renamed and configured to sideload a malicious DLL, vsdbg.dll. That loader installs two components: the newly described Rapuncel infostealer and a kernel driver named Alinubx.sys. According to the researchers, the loader was built with the Cruciferra PUROSANGUE crypter.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAlinubx.sys: a Microsoft-signed kernel driver that targets 145 antivirus and EDR processes
The kernel driver is signed through Microsoft's Windows Hardware Compatibility Publisher chain and is not currently listed in Microsoft's vulnerable drivers blocklist. In the campaign it is disguised as an NVIDIA component, nvfsflt64.sys, and registers as the NvFsFilter service. LastPass and Delphos Labs say the driver is an EDR killer: it contains a hardcoded list of 145 antivirus and endpoint detection and response processes that it aims to terminate.
LastPass explains why this driver is potent against modern protections: by calling ObOpenObjectByPointer with AccessMode=KernelMode, the driver asks the kernel to open targeted processes as kernel code and bypass the normal user-mode SeAccessCheck path at handle-open time. That behavior enables the driver to defeat Protected Process Light (PPL), the protection many security products rely on to survive an administrator, the researchers reported. The investigators also observed additional capabilities compiled into Alinubx.sys — file and registry hiding, DLL injection, driver and process interception, traffic manipulation, and port redirection — although those features do not appear to be activated in this particular campaign.
Rapuncel infostealer: what it harvests and how stolen data is sent
Once security software is terminated on the device, the Rapuncel infostealer performs broad data collection. The malware harvests credentials stored in 25 web browsers; data from 30 cryptocurrency wallets; session credentials for Discord, Steam, and Telegram; Windows Credential Manager contents; and documents whose names include the strings "password," "seed," "wallet," or "recovery." It also takes screenshots of every connected monitor and collects detailed system information.
To bypass Google's app-bound encryption protections present in Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the browser process and invokes its own Elevation Service. Stolen information is compressed and uploaded to an external endpoint at 2.26.126[.]50 using an HTTP-formatted request sent over raw TCP. Rapuncel persists across reboots by installing itself as a Windows service, ensuring that any security tools that reactivate are again terminated before the infostealer launches. LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of BoryptGrab.
What this means for end users, security teams, and open-source maintainers
- End users: The researchers recommended that users obtain software only from official websites, avoid dubious GitHub repositories, and skip or block promoted results on Google Search. The delivery chain relies on search-driven discovery and imitation, not on exploiting a zero-day in end-user software.
- Security teams: Detection and response must account for a signed kernel driver that currently evades Microsoft’s vulnerable drivers blocklist and that is capable of killing protections by opening processes with kernel-mode access. Teams should monitor for suspicious driver installations, service registrations named NvFsFilter or drivers masquerading as NVIDIA components, and unusual network exfiltration to endpoints such as 2.26.126[.]50.
- Open-source maintainers and platform operators: The campaign demonstrates how threat actors weaponize search engine results and GitHub hosting to distribute malicious installers that mimic legitimate projects. Maintainership and repository reputation signals — and search result promotion controls — are practical points of intervention.
The campaign combines social engineering, legitimate Microsoft components used for DLL sideloading, and a signed kernel driver with explicit EDR-killing logic. The driver’s Microsoft signing status and absence from the blocklist, paired with the driver’s kernel-mode opening of protected processes, are specific details that leave a concrete policy and operational question open: how and when will signed drivers enabling kernel-mode termination of security products be identified and mitigated at scale?
