Attackers are running an active campaign that uses fake GitHub repositories to impersonate LastPass Authenticator and at least 39 other well-known software companies. Victims searching for popular tools land on the fraudulent repos through SEO manipulation; clicking “Download” triggers a chain of redirects that delivers a ZIP file inflated to up to 148 MB — a technique designed to defeat file-size-based security filters.
Inside the archive is a renamed copy of vsdbg.exe, Microsoft’s Visual Studio debugger, configured to sideload a malicious DLL. That DLL deploys two payloads: the Rapuncel infostealer and Alinubx.sys, a kernel driver disguised as an NVIDIA component. The driver carries a hardcoded list of 145 antivirus and endpoint detection (EDR) processes to terminate — including those protected by Windows’ Protected Process Light (PPL). Because the driver opens target processes at the kernel level, it bypasses the user-mode access checks PPL relies on. The driver is signed through Microsoft’s Windows Hardware Compatibility Publisher chain and is not yet on Microsoft’s vulnerable-driver blocklist.
Once security software is neutralized, Rapuncel collects credentials from 25 web browsers, data from 30-plus cryptocurrency wallets, session tokens for Discord, Steam, and Telegram, Windows Credential Manager contents, and documents whose names include “password”, “seed”, “wallet”, or “recovery”. It also captures screenshots of every connected monitor. To bypass Google Chrome’s app-bound encryption, the malware injects a DLL into the browser process. Rapuncel persists as a Windows service, so any security tool that restarts is killed again on the next boot. Stolen data is exfiltrated to 2.26.126[.]50. Researchers at LastPass and Delphos Labs assess the malware with moderate confidence as a variant of the BoryptGrab family, built with the Cruciferra PUROSANGUE crypter.
How to check if you’re affected
Affected devices are Windows systems where software was recently downloaded from a GitHub repository impersonating a known brand. Steps to check:
- Open Windows Services (
services.msc) and look for a service named NvFsFilter or a driver filenvfsflt64.sysoutside of a genuine NVIDIA installation underC:\Windows\System32\drivers. - If you downloaded an authentication app, password manager, or developer tool from GitHub recently, verify the publisher is the official, verified organization account — not a look-alike.
- Run a full antivirus scan; unexpected security tool crashes or disabled protection are a strong indicator of compromise from the kernel driver component.