A sophisticated malware campaign has been uncovered employing a Microsoft-signed kernel driver to disable 145 antivirus and endpoint protection processes and exfiltrate sensitive data including passwords, cryptocurrency wallets, browser sessions and more.
How the attack unfolds
Researchers from the LastPass Threat Intelligence team, collaborating with Delphos Labs, identified the operation—named “Rapuncel”—after detecting attackers impersonating LastPass Authenticator through fraudulent GitHub pages. The adversaries created convincing clone pages optimized for search engines, using the LastPass brand and offering a download option that took users through a chain of GitHub Pages and Cloudflare-protected infrastructure before landing on malicious payload servers.
The payloads arrived in large ZIP archives—often exceeding 100 MB—and included dummy files meant to strain or evade automated detection and sandbox systems. Within, a Microsoft debugging executable (vsdbg.exe) was renamed and paired with a malicious DLL (vsdbg.dll) that uses DLL side-loading to trick Windows into loading the dangerous component under the guise of legitimacy.
Signed driver bypasses defenses and steals credentials
After executing, the malware installs a kernel driver called Alinubx.sys (renamed from nvfsflt64.sys) and registered under the name “NVIDIA File System Filter Driver,” but with valid Windows Hardware Compatibility Publisher digital signatures. This driver is programmed with a hardcoded list of 145 security tool process names—including antivirus and endpoint detection and response (EDR) products—and terminates them even if they are protected by Windows Protected Process Light technology.
Once security defenses are neutralized, Rapuncel goes to work collecting a wide array of credentials and personal data. Targets include saved browser passwords from over 25 browsers, Chrome and Edge app-bound encryption keys via process injections, cryptocurrency wallet files, session tokens from Discord and Steam, Telegram data, Windows Credential Manager items, recovery seed words, and documents mentioning “wallet,” “password,” “seed,” or “recovery.” Screenshots and files matching those keywords are also grabbed and then zipped up and sent to a command-and-control server.
Technical indicators & mitigation advice
Forensic teams are urged to watch for certain indicators of compromise: creation of a service labeled NvFsFilter, installation of the malicious driver file at C:\Windows\System32\drivers\nvfsflt64.sys, device paths such as \\.\Alinubx, files like ProtectR3.dll, vsdbg.dll, versions of vsdbg.exe launching unusual child processes, or signature metadata connected to Henan Dafeng Software Co., Ltd. Domains like albinofennel[.]com, hanselarinmusky[.]com, fake GitHub repos under “LastPass-Authenticator”, and IP 2.26.126[.]50 are part of the attacker’s infrastructure.
If your system is infected, assume all credentials—including browser sessions, application tokens, and wallet data—have been compromised. Use a clean device to change passwords, reset tokens, and secure your seed phrases.
This is not an attack on LastPass systems—they were not compromised. The threat actors merely spoofed the LastPass Authenticator brand to lure users into installing malware hosted through deceptive GitHub Pages and other attacker-controlled infrastructure.
The use of Microsoft’s signature in this campaign is especially troubling. By signing the malicious driver, threat actors were able to appear trusted to Windows security layers, evading standard defenses including signature-based detection tools and Microsoft’s vulnerable driver blocklist, which did not flag this driver.
Analysts warn that the tactic of abusing trusted signatures to disable security tools is escalating. This case highlights how threat actors are co-opting vendor-endorsed trust to carry out sophisticated credential theft at scale.
What this means, and what to watch
Attackers leveraging digitally signed kernel drivers represent a major escalation in endpoint threats. With security tools increasingly being bypassed by trusted binaries—and bogus ones being trusted due to legitimate signatures—the window of exposure is growing. Enterprises and individuals alike must update detection tooling to monitor not just unsigned or known-bad drivers, but signed drivers with questionable origin or behavior.
Security operations centers (SOCs) should refine alerting for driver installs matching known IOCs, observe mass termination of security processes, large ZIP downloads from suspicious sources, and unusual DLL side-loading behavior. Defenders need to anticipate that signature-based trust models are no longer enough.
