A new malware campaign is using SEO-optimized GitHub repositories to impersonate LastPass and at least 39 other software companies. Researchers from LastPass and Delphos Labs say the campaign delivers a previously undocumented information stealer called Rapuncel.
The attack starts when users search Google for popular software and click links to fake GitHub repositories. Download buttons redirect victims to external servers, which deliver ZIP archives inflated to as much as 148 MB to help bypass security scanning.
The archive contains a renamed copy of Microsoft's legitimate Visual Studio CoreCLR Debugger (vsdbg.exe). It is configured to load a malicious DLL library (vsdbg.dll), which installs Rapuncel and a malicious Windows kernel driver.
The driver is disguised as an NVIDIA component called nvfsflt64.sys and registers as the NvFsFilter service. Researchers say it contains a hardcoded list of 145 antivirus and EDR processes that it attempts to terminate. It uses the Windows kernel function ObOpenObjectByPointer with AccessMode=KernelMode, allowing it to bypass normal user-mode access checks and terminate protected security processes, including the processes using Protected Process Light (PPL).
The driver is currently not included in Microsoft's vulnerable driver blocklist and is signed through Microsoft's Windows Hardware Compatibility Publisher chain.
After security software is disabled, Rapuncel collects sensitive data from infected systems. It is able to collect credentials from 25 browsers, data from 30 cryptocurrency wallets, Discord, Steam and Telegram sessions, Windows Credential Manager data, screenshots from connected monitors, system information, and documents containing terms such as ‘password,’ ‘seed,’ ‘wallet’ or ‘recovery.’
Rapuncel can also bypass Google's app-bound encryption protections in Chrome, Edge and related browsers by injecting a helper DLL and using its own Elevation Service. Stolen data is compressed and sent to an external server through an HTTP-formatted request over raw TCP.
The malware establishes persistence through a Windows service, allowing it to survive reboots and terminate security software again when it starts.
LastPass and Delphos Labs assess with moderate confidence that Rapuncel is a variant of BoryptGrab. They also found that its loader uses the Cruciferra PUROSANGUE crypter.
Researchers recommend downloading software only from official vendor websites and avoiding suspicious GitHub repositories and promoted search results that lead to unofficial downloads.