Rapuncel Infostealer & Alinubx.sys EDR-Killer Driver

LastPass and Delphos Labs jointly disclosed an ongoing campaign that uses SEO-optimized fake GitHub organizations to impersonate LastPass Authenticator and at least 39 other software brands (password managers, cryptocurrency apps, financial and productivity tools). LastPass first detected the operation on 2026-08-13 after finding a fraudulent GitHub organization at github.com/LastPass-Authenticator. The kit delivers a previously undocumented information stealer the researchers named Rapuncel, assessed with moderate confidence to be a variant or sibling build of the BoryptGrab family Trend Micro documented in March 2026. The objective is broad credential and asset theft, not espionage: browser passwords, cryptocurrency wallets, chat-app sessions, Windows Credential Manager contents, keyword-matched documents, and screenshots.

The attack chain: a victim searching for software (e.g. "LastPass Authenticator download") lands on a fake GitHub org showing fabricated trust badges ("Authorized Access," "VirusTotal Approved," "Secure Archive") and is routed through a chain of GitHub Pages relay accounts to a Cloudflare-fronted traffic-director before downloading a ZIP archive inflated with junk padding to 127.9-148MB to dodge scanner file-size limits. Inside is a renamed copy of Microsoft's own Visual Studio CoreCLR Debugger, vsdbg.exe, which sideloads a malicious vsdbg.dll from the same folder. The loader (a .NET NativeAOT binary built with the Cruciferra PUROSANGUE crypter) escalates to SYSTEM, then installs a Microsoft-signed kernel driver, Alinubx.sys, on disk as nvfsflt64.sys disguised as an NVIDIA component and registered as the NvFsFilter service. The driver calls ObOpenObjectByPointer with AccessMode=KernelMode to bypass Protected Process Light and terminate a hardcoded list of 145 AV/EDR processes. With defenses down, Rapuncel harvests credentials from 25+ browsers (bypassing Chrome/Edge App-Bound Encryption via Elevation Service DLL injection), 30+ crypto wallets, Discord/Steam/Telegram sessions, Windows Credential Manager, keyword-matched documents, and monitor screenshots, then exfiltrates the compressed haul to 2.26.126[.]50 over an HTTP-formatted request sent over raw TCP. Rapuncel persists as a Windows service so any restarted security tool is killed again before the next collection cycle.

The single highest-value defensive angle is the DLL-sideload execution moment (Section 8, Q1): it is the one point in the chain unique to this loader family and it is cheap to detect once legitimate Visual Studio / VS Code debugger paths are excluded. The second highest-value angle is the driver-write and service-creation pair (Q2/Q3), since the exact on-disk filename, path, and service name are reported consistently across the press outlets covering the single LastPass/Delphos Labs joint report (Section 2). Because this is a textbook Bring-Your-Own-Vulnerable-Driver (BYOVD) technique, the Microsoft Defender ASR rule "Block abuse of exploited vulnerable signed drivers" is a near-perfect fit and is called out as the top hardening priority in Section 12.

Defender priority: deploy Q1, Q2, Q3 and Q5 (Section 8) as Custom IOAs this week (Section 9), enable the vulnerable-driver-abuse ASR rule (Section 12), and consider blocking outbound to 2.26.126.50 at the perimeter once you have confirmed the address is not shared hosting, ISP space, or CDN infrastructure in your own environment (netblock ownership was not verified against any source; see Section 3 H4). This campaign traces to a single primary source (the LastPass/Delphos Labs joint report, Section 2), so 2.26.126.50, Alinubx.sys, and nvfsflt64.sys ship at detect/high rather than prevent/critical (Section 10) until a second independent research organization corroborates or you validate a hit locally. Because Alinubx.sys's whole purpose is killing AV/EDR processes, assume your own endpoint telemetry can go dark mid-incident on an affected host: forward DNS, proxy, and Windows Security event logs off-endpoint continuously (Section 7) so later attack-chain steps stay visible even if the local sensor is impaired. No public sample hash exists for Rapuncel, vsdbg.dll, or Alinubx.sys as of 2026-09-19; treat the placeholder hash rows in Section 10 as an open action item, not a gap in this pack.

Six sources were fetched directly for this pack; verbatim snapshots are saved in Rapuncel-Stealer-GitHubSEO-Hunt-sources/ for provenance validation. No LastPass or Delphos Labs primary-source blog post or advisory URL could be located and fetched independently as of 2026-09-19 (search did not surface one); this pack instead relies on the joint report as it is quoted and summarized across five secondary-press outlets. Those outlets corroborate that the joint report was faithfully covered, not that its indicators were independently confirmed by separate research; under the two-independent-source rule this campaign has one primary source (see the Cross-reference & provenance decisions below). No hostile or injected instructions directed at an AI agent were found in any fetched source; all six read as ordinary security journalism.

Cross-reference & provenance decisions

Reading note: this section previously described several indicators as "corroborated by N independent sources." That overstated things. All six outlets above are restating the same single LastPass/Delphos Labs joint report; none did independent research or independently observed campaign infrastructure. A count of how many outlets chose to reprint a given detail measures how faithfully the press covered the joint report, not how many separate parties confirmed it. Under the two-independent-source rule this campaign currently has one primary source, full stop. The bullets below are corrected to say so, and the affected indicators are shipped at detect rather than prevent/critical until either a second independent research organization publishes on this campaign or an analyst validates a hit locally (see the note under Section 10's IOC CSV).

• IPv4 2.26.126.50 (exfil/C2): appears in three of the six outlets (BleepingComputer, the DEV Community digest, Tech Times), all restating the same joint report. One primary source, not three independent ones. Shipped as detect/high, not prevent/critical, pending independent corroboration or local validation.
• Alinubx.sys / nvfsflt64.sys (driver filenames): appear in three to five of the six outlets, again all restating the same joint report. One primary source. Shipped as detect/high, not prevent/critical. These are also bare filenames with no published hash anywhere in any fetched source, which is a weak anchor for a blocking action on its own even setting the source-count question aside; Q2/Q3 key on the exact disk path and service name for specificity rather than the filename alone.
• vsdbg.dll: appears in four of the six outlets, same single joint report. Shipped as detect for two stacked reasons: the one-primary-source situation above, and vsdbg.dll being a generic filename that can legitimately exist inside real Visual Studio / VS Code debugger installs. Block only with the path/hash context in Q1, never the bare filename.
• albinofennel[.]com (payload server): appears in only one of the six outlets (Tech Times), itself a restatement of the same joint report, so there is no outlet-count question here at all: this is transparently one source. Shipped as detect, medium confidence.
• CcProtect.sys / Henan Dafeng Software / CnCrypt v1.32 (original driver identity before renaming): named only by Tech Times, restating the joint report. This is attribution context, not a campaign-controlled indicator (CcProtect.sys is a legitimate third-party vendor driver being abused), so it is not shipped as a blockable IOC anywhere in this pack; it is recorded in Section 10's behavioral/tooling reference only.
• Filegraber staging directory, UserInformation.txt / BUILD NAME artifact, Alinubx.ccf config file, the /upload HTTP/1.1 framing detail: all named only by Tech Times, restating the joint report. Recorded as behavioral hunting leads (Section 10) with the single-source caveat repeated at point of use; none appear in the Falcon IOC Management CSV.
• github.com/LastPass-Authenticator: appears in two of the six outlets (BleepingComputer, CyberInsider), both restating the same joint report rather than confirming it independently. Not shipped as a Falcon Custom IOC regardless of source count (github.com is shared legitimate infrastructure and cannot be domain-blocked); carried into Section 7 as a brand-protection / native hunting item.

Hunt hypotheses (ordered by fidelity)

Attack chain

Known telemetry risk: because Alinubx.sys's entire purpose is killing 145 named AV/EDR processes, if the Falcon sensor process is on that list, local endpoint telemetry can go dark starting at Step 6. Forward DNS, proxy, and Windows Security event logs off-endpoint continuously (Section 7) so Steps 7 and 8 remain observable even on a host where local EDR has been impaired.

File hashes

No SHA256/SHA1/MD5 sample hash has been published by any fetched source for the Rapuncel payload, the vsdbg.dll loader, or the Alinubx.sys driver binary as of 2026-09-19. Tech Times reports the driver scored 0/72 detections on VirusTotal precisely because its filename change produced a hash the blocklist had never seen, but no source publishes that hash. The rows below are labelled placeholders, not indicators; do not import them into Falcon as-is. Populate them from an internal sample capture (this pack's own environment) or a future vendor update, then move them out of placeholder status.

Network indicators

Host indicators

Non-CQL checks that cover the gaps flagged in Sections 5 and 6, or give an environment without Falcon coverage a starting point.

• Proxy / SWG / DNS logs: a request to a GitHub organization or repository page whose name pairs a known brand with "Authenticator" or "download," followed within minutes by a ZIP download over roughly 100MB from a non-github.com final-redirect host.
• Windows Security Event 7045 (Service Installed) / 4697: a service named NvFsFilter, or a service image path referencing nvfsflt64.sys, especially where the claimed publisher (NVIDIA) does not match the actual signing chain (Windows Hardware Compatibility Publisher).
• Sysmon Event ID 6 (Driver Loaded): Alinubx.sys / nvfsflt64.sys hash and signature-family monitoring; Sysmon can capture kernel driver loads that a killed Falcon sensor might miss.
• Sysmon Event ID 7 (Image Loaded): vsdbg.dll module load into a process whose parent image sits outside the legitimate Visual Studio / VS Code debugger tree.
• Windows Defender / third-party AV service-stop or tamper events: a burst of AV/EDR service-stop events across multiple products on the same host within a short window, as a native substitute for Q4 on a host where EDR telemetry itself may be impaired.
• Browser policy verification: confirm Chrome/Edge chrome://policy shows App-Bound Encryption enforced; a host where it silently shows disabled or unset merits investigation.
• Registry audit (native, non-Falcon): presence of an Alinubx or NvFsFilter key under HKLM\SYSTEM\CurrentControlSet\Services, and, if a future sample carries it, an Alinubx.ccf file anywhere on disk, since that file is what would activate the driver's dormant rootkit capabilities (single-source lead, Tech Times only).
• GitHub organization / brand-protection monitoring: search github.com for organizations or repositories using your own product or brand name plus "Authenticator," "download," or "installer," and file takedown requests; this initial-access surface is outside all EDR telemetry.

Promote to Custom IOA

Investigate-only (do not auto-block)

Q4, Q6, Q7, Q8, and Q9 carry medium-to-high FP risk and depend on correlation with Q1/Q2/Q3/Q5 to reach alerting confidence. Run as scheduled searches feeding a triage queue, not as blocking IOAs, until a tuning pass against your own environment's baseline reduces the noted FP sources to near-zero.

type,value,action,severity,expiration,description,tags
ipv4,2.26.126.50,detect,high,2026-12-19,Rapuncel exfiltration/C2 endpoint (HTTP-formatted request over raw TCP). Single-primary-source: LastPass/Delphos Labs joint report; reprinted by 3 of 6 outlets not independently confirmed; netblock ownership not verified. Shipped detect pending local validation or a second independent research org; promote to prevent once either condition is met.,campaign:Rapuncel
filename,Alinubx.sys,detect,high,2026-12-19,EDR-killer kernel driver original/internal name; 145-process AV/EDR kill list. Bare filename with no published hash: a weak anchor on its own. Single-primary-source: joint report; reprinted by 3-5 of 6 outlets not independently confirmed. Shipped detect pending local validation or a second independent research org.,campaign:Rapuncel
filename,nvfsflt64.sys,detect,high,2026-12-19,Alinubx.sys deployed on disk disguised as an NVIDIA component. Bare filename with no published hash: a weak anchor on its own. Single-primary-source: joint report; reprinted by 3-5 of 6 outlets not independently confirmed. Shipped detect pending local validation or a second independent research org.,campaign:Rapuncel
filename,vsdbg.dll,detect,medium,2027-03-19,Malicious sideload DLL loaded by renamed vsdbg.exe installer. Generic filename; pair with path/hash context before blocking,campaign:Rapuncel
domain,albinofennel.com,detect,medium,2026-12-19,Primary payload/lure server hosting 40+ brand impersonation pages. Single-sourced (Tech Times only); revalidate before promoting to prevent,campaign:Rapuncel
sha256,REPLACE_WITH_RAPUNCEL_PAYLOAD_SHA256,detect,high,2027-03-19,Rapuncel infostealer payload PE. No public hash published as of 2026-09-19; populate from internal sample capture,campaign:Rapuncel
sha256,REPLACE_WITH_VSDBGDLL_LOADER_SHA256,detect,high,2027-03-19,vsdbg.dll sideload loader. No public hash published; populate from internal sample capture,campaign:Rapuncel
sha256,REPLACE_WITH_ALINUBXSYS_DRIVER_SHA256,detect,critical,2027-03-19,Alinubx.sys driver binary. VirusTotal reported 0/72 detections pre-rename per Tech Times but no hash value was published; populate from internal capture,campaign:Rapuncel

Sideload carrier: legitimate vsdbg.exe (renamed as an installer) sideloading vsdbg.dll from the same folder
Driver on-disk path: C:\Windows\System32\drivers\nvfsflt64.sys ; device object \\.\Alinubx (single-source)
Service: NvFsFilter, claims to be an NVIDIA component but signed only via Windows Hardware Compatibility Publisher
Driver PPL bypass: ObOpenObjectByPointer with AccessMode=KernelMode against a hardcoded list of 145 AV/EDR processes
Dormant driver capabilities (not active in this campaign, requires undeployed Alinubx.ccf): file/registry hiding, DLL injection, driver/process interception, WFP traffic redirection
Delivery archetype: SEO-poisoned fake GitHub org impersonating a target brand -> GitHub Pages relay chain -> Cloudflare-fronted traffic-director -> ZIP inflated to 127.9-148MB with junk padding
Fake trust badges on lure page: "Authorized Access", "VirusTotal Approved", "Secure Archive", animated "Validating session / Generating secure token"
Loader: .NET NativeAOT-compiled binary, Cruciferra PUROSANGUE crypter, COM Elevation Moniker UAC bypass among 3 privilege-escalation attempts to SYSTEM
Browser bypass: helper DLL injected into Chrome/Edge, decryption requested via the browser's own Elevation Service to defeat App-Bound Encryption
Persistence: Rapuncel installs as a Windows service, re-killing security tools on every reboot before re-running collection
Collection staging artifacts (single-source, Tech Times): misspelled "Filegraber" directory; UserInformation.txt file with a BUILD NAME field
Steam handling: launched silently if not already running, to extract session credentials from memory
Document targeting keywords in filename: password, seed, wallet, recovery
Exfil framing (single-source detail): /upload HTTP/1.1 request framing to 2.26.126[.]50; source itself flags this as correlation context, not a standalone block rule
Fraudulent GitHub organization: github.com/LastPass-Authenticator (brand-specific; the same kit hosts equivalent orgs for 39+ other brands)

Rapuncel - newly documented infostealer (LastPass/Delphos Labs naming, disclosed 2026-09-17); moderate-confidence variant/sibling of BoryptGrab
BoryptGrab - infostealer family documented by Trend Micro, March 2026; shares Filegraber/UserInformation.txt artifact naming with Rapuncel per source, but payloads are not byte-identical and share no published hashes
Alinubx.sys - EDR-killer kernel driver; per Tech Times (single-source attribution) a renamed/resubmitted variant of CcProtect.sys, a legitimate process-protection driver from Henan Dafeng Software Co., Ltd.'s CnCrypt disk-encryption product (v1.32); CcProtect.sys is separately listed on the LOLDrivers registry with public proof-of-concept kill code
Cruciferra PUROSANGUE - loader/crypter package used to build the .NET NativeAOT loader, previously documented by Proofpoint and eSentire
Distribution kit - SEO-optimized fake GitHub organizations, GitHub Pages relay chain, Cloudflare-fronted traffic-director; assessed as a Malware-as-a-Service style platform simultaneously impersonating 40+ software brands

[ ] ASR rule "Block abuse of exploited vulnerable signed drivers" (56a863a9-875e-4185-98a7-b882c64b5ce5) - deployed and enforced
[ ] HVCI / Memory Integrity (or Smart App Control) enabled fleet-wide - verified
[ ] WDAC policy enforcing Microsoft's recommended vulnerable-driver blocklist, extensible with Alinubx.sys/CcProtect.sys once a hash is obtained - deployed
[ ] Egress block on 2.26.126.50 - deployed
[ ] Chrome/Edge Enterprise: App-Bound Encryption verified active at chrome://policy; browser extension install allowlist enforced - verified
[ ] Credential Guard enabled fleet-wide - verified
[ ] DNS / Proxy / Windows Security event logs configured to ship off-endpoint continuously, independent of local EDR health - verified
[ ] Software-download policy restricting installs to vendor-official sites or managed app stores communicated to users - verified

JSON (machine-readable)

{
  "pack": "Rapuncel-Stealer-GitHubSEO-Hunt",
  "version": "0.1",
  "date": "2026-09-19",
  "indicators": {
    "ipv4_exfil": ["2.26.126.50"],
    "domain_single_source": ["albinofennel.com"],
    "driver_filenames": ["Alinubx.sys", "nvfsflt64.sys"],
    "loader_filenames_generic_detect_only": ["vsdbg.exe", "vsdbg.dll"],
    "service_name": ["NvFsFilter"],
    "device_object_single_source": ["\\\\.\\Alinubx"],
    "sha256_placeholders_no_public_hash": [
      "REPLACE_WITH_RAPUNCEL_PAYLOAD_SHA256",
      "REPLACE_WITH_VSDBGDLL_LOADER_SHA256",
      "REPLACE_WITH_ALINUBXSYS_DRIVER_SHA256"
    ]
  }
}

Playbook A - ASR rule for vulnerable signed drivers (Windows, PowerShell)

Prerequisites: Windows 10 1709+/Server 2019+ with Microsoft Defender Antivirus present as the
  active AV component (required by ASR even in EDR-primary/passive-mode configurations); test in
  Audit mode before Enforce; confirm no legitimate line-of-business driver installer will be
  affected (this rule specifically targets known-vulnerable signed drivers, so collateral impact
  is expected to be minimal).
Reboot required: No

Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
  -AttackSurfaceReductionRules_Actions AuditMode

# after 7-day audit review shows no legitimate driver installers affected:
Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
  -AttackSurfaceReductionRules_Actions Enabled

# Verify:
(Get-MpPreference).AttackSurfaceReductionRules_Actions

Rollback: Set-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 `
  -AttackSurfaceReductionRules_Actions Disabled

Playbook B - Firewall block for reported exfil IP (Windows, PowerShell)

Prerequisites: Local admin or GPO deployment rights; PowerShell 5.1+; confirm 2.26.126.50 is not
  in use by any legitimate internal service before blocking (run Q5 in Investigate mode first).
Reboot required: No

New-NetFirewallRule -DisplayName "BLOCK-Rapuncel-C2-Exfil" -Direction Outbound `
  -RemoteAddress 2.26.126.50 -Action Block -Profile Any -Enabled True

# Verify:
Get-NetFirewallRule -DisplayName "BLOCK-Rapuncel-C2-Exfil" | Get-NetFirewallAddressFilter

Rollback: Remove-NetFirewallRule -DisplayName "BLOCK-Rapuncel-C2-Exfil"

Playbook C - Enable HVCI / Memory Integrity (Windows, registry/GPO)

Prerequisites: Hardware support (VBS-capable CPU, UEFI Secure Boot, virtualization extensions
  enabled in firmware); pilot ring test BEFORE fleet enforcement, since HVCI can block legitimate
  drivers that are unsigned or otherwise incompatible; inventory driver compatibility first.
Reboot required: Yes

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" `
  /v Enabled /t REG_DWORD /d 1 /f
# Equivalent GPO path: Computer Configuration > Administrative Templates > System > Device Guard >
# Turn On Virtualization Based Security > Memory Integrity

# Verify (SecurityServicesRunning value 2 indicates HVCI active):
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | `
  Select-Object SecurityServicesRunning

Rollback: reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" `
  /v Enabled /t REG_DWORD /d 0 /f
  (reboot required to take effect)

Playbook D - WDAC vulnerable-driver blocklist merge (Windows, PowerShell)

Prerequisites: WDAC/Device Guard infrastructure in place; back up the existing policy XML before
  editing; pilot ring identified before fleet-wide Enforce; download Microsoft's current
  recommended driver block rules from the official Microsoft Learn vulnerable-driver-blocklist
  documentation before merging.
Reboot required: Yes for a base-policy enforcement-mode change on OS builds without dynamic
  policy refresh support; a signer/rule addition to an already-enforced policy can often apply via
  CiTool --refresh alone; validate in your pilot ring.

# Merge the downloaded Microsoft recommended driver-block-rules policy into your base WDAC policy,
# then deploy the compiled .cip to the active policy store:
Merge-CIPolicy -PolicyPaths "BaseWDACPolicy.xml","MicrosoftRecommendedDriverBlockRules.xml" `
  -OutputFilePath "MergedWDACPolicy.xml"
ConvertFrom-CIPolicy -XmlFilePath "MergedWDACPolicy.xml" -BinaryFilePath "MergedWDACPolicy.cip"
Copy-Item "MergedWDACPolicy.cip" "$env:windir\System32\CodeIntegrity\CiPolicies\Active\"
CiTool --refresh -json

# Verify:
CiTool --list-policies -json

Rollback: CiTool --remove-policy {policy-GUID-here} -json
  (restore the prior .cip from backup if reverting rather than removing entirely)

Playbook E - Chrome/Edge extension allowlist + App-Bound Encryption check (GPO ADMX / registry)

Prerequisites: Chrome Enterprise ADMX templates installed in the GPO Central Store; test in a
  pilot OU first, restricting extension installs is user-visible and will generate helpdesk
  tickets if not communicated in advance.
Reboot required: No (policy applies on next Chrome/Edge restart or gpupdate)

# Block all extensions by default, then allowlist specific vetted extension IDs (repeat the
# Allowlist key with incrementing numeric suffixes for each approved extension, including any
# vetted cryptocurrency wallet extensions your organization permits):
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ `
  /d "<vetted-extension-id-here>" /f

# Verify App-Bound Encryption is active (Chrome 127+ default; confirm via chrome://policy on a
# sample endpoint rather than only trusting the registry default):
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionInstallBlocklist

Rollback: reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionInstallBlocklist /f
          reg delete "HKLM\SOFTWARE\Policies\Google\Chrome" /v ExtensionInstallAllowlist /f

Validation gates (Section 11) are folded in here: telemetry-readiness and benign-baseline review must both be confirmed per-tenant before any "Good" or "Partial" row above is treated as production-ready in your environment.

All six source snapshots (verbatim fetched text) are saved under Rapuncel-Stealer-GitHubSEO-Hunt-sources/ alongside this file for provenance validation. No hostile or injected instructions directed at an AI agent were found in any fetched source.