Rapuncel Browser Helper DLL Bypassing Chrome App-Bound Encryption

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects a malicious browser helper DLL (Rapuncel) that attempts to inject into web browsers like Chrome and Edge. The rule identifies code that interacts with the browser's Elevation Service 'DecryptData' method, a technique used to bypass app-bound encryption, potentially to extract sensitive information like stored credentials.