Rapuncel Infostealer Distributed via Fake GitHub Organizations

In late 2026, the LastPass TIME Team and Delphos Labs identified a multi-stage Malware-as-a-Service (MaaS) campaign impersonating at least 40 brands, including LastPass, on GitHub. The campaign uses SEO-optimized repositories and complex GitHub Pages redirect chains to deliver high-volume ZIP archives. These archives contain the Rapuncel infostealer and a malicious kernel driver, Alinubx.sys, which is signed by Microsoft's Hardware Compatibility Publisher chain to bypass modern trust controls.

The technical backbone of this attack involves Bring Your Own Vulnerable Driver (BYOVD) tactics. The Alinubx.sys driver is a renamed variant of CcProtect.sys, which utilizes kernel-mode privileges to terminate 145 different antivirus and EDR processes. Once defenses are neutralized, the Rapuncel payload exfiltrates credentials, cryptocurrency wallets, and session tokens from over 25 browsers and 30 wallet applications, using sophisticated DLL injection to bypass Google's app-bound encryption.

This campaign represents a significant threat to corporate and personal identities due to its ability to neutralize endpoint security from the kernel level. By leveraging legitimate Microsoft signatures and reputable platforms like GitHub, the actors successfully bypassed VirusTotal detections and established trust, highlighting a critical failure in traditional signature-based detection and blocklisting methodologies.