This ongoing malware campaign leverages SEO-optimized fake GitHub repositories impersonating LastPass Authenticator and at least 39 other companies to distribute the previously undocumented Rapuncel infostealer. Victims searching for legitimate software are redirected to malicious repositories that deliver ZIP archives containing a renamed Microsoft Visual Studio CoreCLR Debugger executable configured to sideload a malicious DLL. This DLL installs the Rapuncel infostealer and a Microsoft-signed kernel driver (Alinubx.sys) disguised as an NVIDIA component. The driver terminates 145 known antivirus and EDR processes by opening them with kernel-level access, bypassing Protected Process Light protections. Rapuncel steals credentials from 25 web browsers, 30 cryptocurrency wallets, session tokens from Discord, Steam, and Telegram, Windows Credential Manager data, sensitive documents, screenshots, and detailed system information. It uploads stolen data to an external server and persists across reboots by reinstalling itself and disabling security software again. The driver also contains additional stealth and manipulation capabilities not activated in this campaign. Researchers assess Rapuncel as a variant of BoryptGrab with a loader built using the Cruciferra PUROSANGUE crypter.

The campaign enables attackers to disable a wide range of antivirus and endpoint detection and response products, effectively neutralizing security defenses on infected systems. This allows the Rapuncel infostealer to exfiltrate sensitive credentials, cryptocurrency wallet data, session tokens, and confidential documents, potentially leading to account compromise, financial theft, and data breaches. Persistence mechanisms ensure continued infection and repeated disabling of security tools after system reboots.

Users should avoid downloading software from unofficial or suspicious GitHub repositories and be cautious of promoted search results that may lead to malicious sites. There is no vendor patch available for the malicious driver or infostealer; mitigation relies on user vigilance and blocking access to known malicious domains and repositories. Security teams should monitor for the presence of the Alinubx.sys driver and the Rapuncel infostealer, though detection may be challenging due to the driver's kernel-level capabilities and Microsoft signature. Since the driver is not currently on Microsoft's vulnerable driver blocklist, organizations should watch for updates from Microsoft regarding blocking this driver. No official fix or patch is currently available.