Rapuncel Browser DLL Injection Bypassing App-Bound Encryption

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•5

Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.