As reported by BleepingComputer, a newly documented infostealer dubbed Rapuncel is being distributed through SEO-optimized GitHub repositories impersonating LastPass and at least 39 other recognizable software brands. While the social-engineering vector is familiar, the technical payload chain warrants serious attention from defenders: it combines DLL sideloading via a legitimate Microsoft binary, an EDR-killing kernel driver signed through Microsoft's own compatibility publisher chain, and archive inflation to evade gateway scanning.

Threat Alert: Information stealers are commodity threats, but three characteristics of this campaign elevate it above baseline noise:

Why This Campaign Is More Than Another Stealer

Information stealers are commodity threats, but three characteristics of this campaign elevate it above baseline noise:

Why This Campaign Is More Than Another Stealer
Trust-chain abuse: The kernel driver is signed through Microsoft's Windows Hardware Compatibility Publisher — not a stolen or leaked certificate from a no-name vendor. This means driver blocklist policies alone are insufficient. Microsoft's signing infrastructure is being leveraged as a kill-switch against the very EDR products that rely on it.
PPL bypass via kernel-mode handle opening: The driver uses ObOpenObjectByPointer with AccessMode=KernelMode, sidestepping the SeAccessCheck path that Protected Process Light (PPL) depends on. This is a meaningful technical escalation — PPL is the backbone of how modern EDR survives tampering attempts by admin-level attackers.
GitHub as a malicious distribution platform: SEO-poisoned repositories on github.com inherit the domain reputation of GitHub itself. URL filtering and allowlisting approaches that trust github.com by default will fail here.

Who Is Most Exposed

The primary infection vector is users searching for authenticator apps, password managers, or crypto-adjacent tooling and downloading from GitHub repos that appear legitimate. This places several populations at elevated risk:

  • Cryptocurrency users and DeFi professionals — Rapuncel targets 30 wallet extensions and searches for files named with terms like "seed," "wallet," and "recovery."
  • Developer and IT admin workstations — these users frequently download tooling from GitHub and often have broader access to corporate environments, making them high-value footholds.
  • Organizations relying on PPL-based EDR without driver blocklist enforcement — if the EDR killer succeeds, subsequent post-exploitation is effectively invisible to that endpoint's telemetry.

The Bigger Problem: Signed Drivers as Attack Infrastructure

The driver used in this campaign is not currently on Microsoft's vulnerable driver blocklist. That gap is the real story — by the time a driver lands on the blocklist, campaigns have already burned through their window of opportunity.

Microsoft's HVCI and driver blocklist mechanisms are reactive by design. Attackers understand this and rotate drivers faster than Microsoft can enumerate them. The fact that Alinubx.sys contains dormant capabilities for DLL injection, traffic manipulation, and port redirection — even if unused in this campaign — suggests the infrastructure is being staged for broader operations, potentially including ransomware deployment down the line.

Shield53 Recommendations

  • Enforce HVCI and Memory Integrity on all supported Windows endpoints. This prevents unsigned or improperly signed drivers from loading, even if they bypass the blocklist.
  • Deploy Microsoft's recommended driver blocklist policy via Group Policy or MDM, and enable the CodeIntegrity event logging channel to detect blocklist hits and attempted driver loads.
  • Treat github.com as a sanctioned-download-only zone. Implement content filtering that blocks direct downloads from arbitrary GitHub release URLs unless they appear on an approved-repository allowlist maintained by security or IT.
  • Hunt for the IoCs in this chain: Monitor for vsdbg.exe executing from non-Visual Studio paths, nvfsflt64.sys or NvFsFilter service registration on systems without legitimate NVIDIA filter drivers, and ZIP archives exceeding ~100MB arriving via browser downloads.
  • Assume EDR blindness is possible. Correlate EDR telemetry gaps with identity and network logs. If an endpoint's EDR process stops unexpectedly, trigger an automated isolation workflow rather than waiting for analyst triage.
  • Educate users on software sourcing. Authenticator apps and password managers should be downloaded from vendor websites or official app stores — never from GitHub search results. This is a simple control with outsized impact.

The Rapuncel campaign is a reminder that the most dangerous threats don't exploit zero-days in software — they exploit trust in the platforms and signing ecosystems we've built our defenses around. Defenders need to assume that trust is already compromised and design detection and response accordingly.