An ongoing malware campaign is using SEO-optimized GitHub repositories to impersonate well-known software companies in order to promote a previously undocumented information theft operation called Rapuncel.
LastPass and Delphos Labs have uncovered the campaign in which they reportedly impersonate the password manager brand and at least 39 other companies.
In addition to the Rapuncel infostealer, the repositories provide a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.
The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.
There, clicking the download buttons triggers a series of redirects before reaching the payload delivery servers, where victims receive ZIP archives increased in size up to 148 MB to bypass security scans.
The installer in the archives is a copy of the legitimate Microsoft Visual Studio CoreCLR debugger “vsdbg.exe”, which has been renamed and configured to sideload a malicious DLL (vsdbg.dll). The installer provides the Rapuncel infostealer as well as the Alinubx.sys kernel driver, which is used to terminate antivirus software.
Source: LastPass
The kernel driver is disguised as an NVIDIA component named “nvfsflt64.sys” and registers itself as an NvFsFilter service.
According to the researchers, the driver acts as an EDR killer that contains a hard-coded list of 145 antivirus and EDR processes that it is supposed to kill.
“The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal SeAccessCheck path in user mode at the time the handle is opened.” explains LastPass.
“It asks the kernel to open the process as kernel code and then kills it. That’s why it can defeat Protected Process Light (PPL); the protection that many security products rely on to survive an administrator.”
Currently, the driver is not on Microsoft’s vulnerable driver blacklist and the driver used in the campaign is signed through Microsoft’s Windows Hardware Compatibility Publisher chain.
Researchers found that Alinubx.sys contains additional functions for hiding files and registries, injecting DLLs, intercepting drivers and processes, manipulating traffic, and port redirection, but does not appear to be enabled in this campaign.
The Rapuncel Infostealer
Once the security software on the device is terminated, Rapuncel infostealer starts stealing data from the infected device.
The malware collects the following information:
- Credentials are stored in 25 web browsers
- Data from 30 cryptocurrency wallets
- Login details for Discord, Steam and Telegram sessions
- Windows Credential Manager contents
- Documents with names that include “Password,” “Seed,” “Wallet,” or “Recovery.”
- Screenshots from each connected monitor
- Detailed system information
To bypass Google’s app-linked encryption protections present in Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the app and calls its own Elevation Service.
The stolen information is compressed and uploaded to an external endpoint at “2,26,126(.)50‘ using an HTTP formatted request sent over raw TCP.
Rapuncel persists through reboots via a Windows service, so any re-enabled security tools will be disabled again before the Infostealer is launched.
LastPass and Delphos Labs concluded with moderate certainty that Rapuncel is a variant of BoryptGrab, while they also found that the loader was built using the Cruciferra PUROSANGUE crypter.
Users are advised to only download software from official websites, avoid dubious GitHub repositories, and skip or block promoted results in Google Search.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL and Atlassian for a two-hour digital summit to learn what attacks are changing at AI speed, what defenders should give up, and how to validate, decide, fix and re-validate at machine speed.
