Microsoft-Signed Driver Exploited to Disable Security Tools, Steal Credentials

Key Takeaways

• A new malware campaign, dubbed Rapuncel, leverages a Microsoft-signed kernel driver to disable 145 different antivirus and endpoint security products.
• Attackers are distributing Rapuncel by impersonating LastPass Authenticator via fake GitHub pages, luring users with seemingly legitimate download links.
• Once security tools are neutralized, Rapuncel steals a wide array of sensitive data, including passwords, cryptocurrency wallet data, browser sessions, and Discord tokens.
• The malicious driver, Alinubx.sys (renamed nvfsflt64.sys), exploits a legitimate Microsoft signature to evade detection and gain system trust.

Cybersecurity researchers have uncovered a sophisticated malware operation employing a Microsoft-attested Windows kernel driver to systematically disable 145 antivirus and endpoint security processes. This tactic paves the way for the exfiltration of sensitive user data, including passwords, cryptocurrency wallet information, and browser session data.

The discovery was made by the LastPass Threat Intelligence, Mitigation, and Escalation team, in collaboration with Delphos Labs. Their investigation began after identifying attackers masquerading as LastPass Authenticator through fraudulent GitHub pages designed to trick unsuspecting users.

Researchers have named the information-stealing malware “Rapuncel.” It is crucial to note that this campaign did not compromise any LastPass systems, services, or customer vaults. Instead, the attackers exploited the LastPass brand name to create convincing fake download pages that appeared legitimate in search engine results.

Victims actively searching for “LastPass Authenticator download” could easily encounter a deceptive GitHub organization crafted to mimic an official product page. These fraudulent pages incorporated LastPass branding, optimized descriptions for search engine visibility, and a prominent download button.

Clicking the download button initiated a complex redirection chain, leading visitors through multiple GitHub Pages sites before ultimately reaching infrastructure controlled by the attackers. The operators cleverly utilized hidden redirect GitHub pages and a Cloudflare-protected traffic layer, enabling them to switch payload servers without needing to update the publicly visible lure pages.

The final payload was delivered as a substantial ZIP archive, often exceeding 100 MB in size. Researchers determined that these oversized archives contained junk files, a deliberate tactic to bypass the limits of automated sandbox environments and scanning tools.

Microsoft-Signed Driver Enables Security Bypass

Within the downloaded ZIP file, attackers bundled a renamed Microsoft debugging executable, vsdbg.exe, alongside a malicious DLL, vsdbg.dll. Windows then loaded this malicious DLL via DLL side-loading, allowing the attackers’ loader to execute under the guise of a legitimate Microsoft component, thus gaining elevated privileges.

Following privilege escalation, the malware deployed a kernel driver named Alinubx.sys, which it saved as nvfsflt64.sys and registered as the “NVIDIA File System Filter Driver.”

This driver possessed a valid Microsoft Windows Hardware Compatibility Publisher signature chain. This signature played a critical role in making the malicious component appear trusted to both Windows and existing security controls, despite its inherent capability to terminate security software.

The driver contained a hardcoded list of 145 process names associated with various antivirus and endpoint detection and response (EDR) products. It leveraged a kernel-level process termination mechanism to halt these targeted tools, even those protected by Windows Protected Process Light (PPL) technology.

Researchers have linked the malicious driver to the CnCrypt or CcProtect driver lineage, which is associated with Henan Dafeng Software. It appears the attackers simply renamed the driver while retaining its dangerous process-killing functionality.

At the time of the researchers’ investigation, the driver was not present in Microsoft’s vulnerable driver blocklist. Its clean, or nearly clean, detection history also allowed it to successfully evade signature-based defenses.

After successfully disabling endpoint security tools, the Rapuncel infostealer proceeded to harvest saved browser passwords from over 25 different web browsers. It specifically targeted Chrome and Edge’s application-bound encryption by injecting itself into browser processes, enabling it to request password decryption from within the browser itself.

Beyond browser data, the malware also collected cryptocurrency wallet files, Discord tokens, Steam session data, Telegram information, Windows Credential Manager data, screenshots, and documents containing keywords such as “password,” “seed,” “wallet,” and “recovery.”

All collected information was compressed into a ZIP file and subsequently transmitted to the command-and-control (C2) endpoint located at 2.26.126[.]50.

What You Should Do

According to a LastPass Threat Intelligence report, organizations and users should implement the following mitigation steps:

• Investigate systems for the creation of the NvFsFilter service or any write operations to C:WindowsSystem32driversnvfsflt64.sys.
• Monitor for other key artifacts, including .Alinubx, Alinubx.ccf, ProtectR3.dll, and instances of “Henan Dafeng Software” within driver-signing metadata.
• Look for renamed vsdbg.exe processes launching unusual child processes, which could indicate DLL side-loading.
• Detect kernel driver loads that are immediately followed by the mass termination of security tools.
• Be vigilant for large ZIP file downloads originating from suspicious GitHub Pages lures.
• If you suspect you have executed the fake installer, treat all credentials stored on the affected system as compromised. Change all passwords, wallet credentials, browser sessions, and application tokens from a separate, known-clean device immediately.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.