Rapuncel Infostealer Uses Signed Windows Driver to Disable 145 Security Tools Before Stealing Credentials

A newly documented Windows malware campaign is turning one of the operating system’s most trusted components against its own defenses.

Security researchers investigating an information stealer known as Rapuncel found that its operators deployed a Microsoft-attested kernel driver capable of terminating 145 antivirus and endpoint detection and response processes before the credential-stealing component went to work.

The campaign is especially significant because the driver was not simply an unsigned malicious file trying to sneak past Windows. Researchers found that it carried a Microsoft Windows Hardware Compatibility Publisher signature and had initially avoided detection by major security scanning engines.

Key Takeaways:

• Rapuncel is distributed through fraudulent GitHub pages impersonating legitimate software brands.
• Its Alinubx.sys kernel driver contains a hardcoded list of 145 antivirus and EDR processes it can terminate.
• The driver was signed through Microsoft’s hardware compatibility infrastructure and was not on Microsoft’s vulnerable-driver blocklist when researchers investigated it.
• Rapuncel targets browser credentials, cryptocurrency wallets and session data from services including Discord, Steam and Telegram.
• The campaign demonstrates why a valid digital signature or clean malware scan cannot, by itself, prove that software is trustworthy.

Fake GitHub Downloads Lead Users Into the Attack

The campaign was uncovered by the LastPass Threat Intelligence, Mitigation, and Escalation team working with Delphos Labs.

Researchers said they initially discovered a fraudulent GitHub organization impersonating LastPass Authenticator on August 13, 2026. Further investigation revealed infrastructure serving impersonation pages for at least 40 companies, suggesting a broader operation rather than an attack focused exclusively on LastPass.

The fake pages were designed to look credible and included misleading trust indicators intended to reassure visitors that the downloads were safe.

Clicking a download ultimately delivered an unusually large ZIP archive. According to the researchers, much of that size came from junk data—an evasion technique that can cause some automated scanners to skip or struggle with the file.

The important distinction here is that LastPass itself was not breached. The company said its services, systems and customer vaults were not compromised; attackers were abusing its brand as a lure.

For users, the practical lesson is simple: finding software through Google, Bing or GitHub does not automatically make the download an official distribution channel.

A Signed Kernel Driver Clears the Way for Rapuncel

The standout component in the attack is Alinubx.sys.

Once attackers obtain sufficient privileges, the malware installs the driver at kernel level—the highly privileged part of Windows responsible for fundamental interactions between hardware, drivers and the operating system.

Researchers found that Alinubx contains 145 hardcoded antivirus and EDR process names. It can open those processes using kernel-level access and terminate them, bypassing protections that are much harder to defeat from an ordinary application.

In simple terms, Rapuncel is not trying to hide indefinitely from every security product.

It first attempts to remove the guards.

That matters because kernel-level access gives malicious software considerably more control than a normal Windows application. Microsoft itself notes that attackers increasingly abuse legitimate but vulnerable signed kernel drivers to gain privileged access, a technique commonly known as Bring Your Own Vulnerable Driver, or BYOVD.

Why the Microsoft Signature Did Not Mean the Driver Was Safe

Researchers linked Alinubx to the CnCrypt/CcProtect driver family from Henan Dafeng Software.

Their analysis found matching product information, versions and process-killing functionality, while the driver identity had been altered.

During the investigation, the Alinubx sample was not included in Microsoft’s vulnerable-driver blocklist. Delphos also reported that an earlier check showed zero detections from 72 VirusTotal engines. Later scans began detecting the sample, illustrating how threat intelligence changes after malware becomes known.

This does not mean Microsoft’s driver protections are useless.

Microsoft explicitly says its vulnerable-driver blocklist is not guaranteed to contain every dangerous driver. The company recommends additional defenses including Hypervisor-Protected Code Integrity (HVCI) and an Attack Surface Reduction rule designed to block abuse of exploited vulnerable signed drivers.

The larger security problem is one of trust.

A digital signature establishes information about the software’s signing chain. It should not be interpreted as a permanent guarantee that the underlying code cannot be abused.

Rapuncel Goes After Browsers, Crypto Wallets and Sessions

Once defensive tools have been disrupted, Rapuncel begins collecting valuable information.

The joint investigation identified targeting of credentials from 19 or more browsers, data associated with 34 or more cryptocurrency wallets, Windows Credential Manager information and session data connected to Discord, Steam and Telegram.

The malware also contains a mechanism for dealing with newer browser protections.

Google introduced App-Bound Encryption in Chrome on Windows to make sensitive browser information harder for ordinary infostealers to decrypt. The protection links encrypted data to the identity of the application requesting access.

Researchers found that Rapuncel attempted to work around those defenses by injecting code into browser processes, allowing requests for decrypted information to originate from a trusted browser context.

That is an important escalation in the long-running contest between browser developers and credential-stealing malware.

Protecting stored credentials remains valuable, but attackers increasingly try to execute code inside trusted processes rather than simply stealing encrypted databases from disk.

What Users and Businesses Should Do

Anyone who actually ran one of the malicious installers should treat credentials stored on that computer as potentially exposed, according to the researchers.

Passwords should be changed using a different, known-clean device. Existing login sessions should also be reviewed and revoked where possible.

Cryptocurrency users face an additional risk. If a wallet seed phrase, recovery information or wallet data was stored on the compromised computer, simply changing a password may not be sufficient.

Businesses should also look beyond file hashes.

Hashes are useful for identifying known malicious files, but attackers can alter binaries and infrastructure. Behavioral indicators—such as unexpected kernel-driver installation, mass termination of security products or unusual activity from legitimate Microsoft utilities—can provide more durable detection opportunities.

Microsoft recommends keeping its vulnerable-driver protections enabled and using layered defenses rather than relying exclusively on blocklists.

The Rapuncel campaign ultimately exposes a wider problem for Windows security: attackers do not always need to break trust mechanisms when they can manipulate them.

For more cybersecurity, malware and emerging technology coverage, visit TechNewsXplore.

FAQ

What is the Rapuncel infostealer?

Rapuncel is Windows credential-stealing malware documented by LastPass and Delphos Labs. It targets browser information, cryptocurrency wallet data and account session credentials while using a kernel driver to disable security software.

How does Rapuncel disable antivirus programs?

Researchers found that its Alinubx.sys driver contains a hardcoded list of 145 antivirus and EDR processes and can terminate targeted processes using privileged kernel-level operations.

Was LastPass hacked by Rapuncel?

No breach of LastPass systems or customer vaults was reported. Attackers impersonated LastPass and other companies through fraudulent external download pages to distribute the malware.

Official / Reliable Sources:

LastPass & Delphos Labs — Rapuncel technical investigation:
Read the joint threat intelligence report

Microsoft — Vulnerable Driver Blocklist and recommended protections:
Microsoft recommended driver block rules

Google Security Blog — Chrome App-Bound Encryption:
Google’s technical explanation of App-Bound Encryption on Windows

Independent security reporting:
BleepingComputer analysis of the Rapuncel campaign