Rapuncel Infostealer Distributed via GitHub Brand Impersonation

In August 2026, the LastPass TIME team and Delphos Labs uncovered a sophisticated campaign using fraudulent GitHub organizations to impersonate over 40 brands, including LastPass Authenticator. The attack leverages SEO-optimized GitHub Pages and a multi-stage redirect chain to deliver the Rapuncel infostealer. The payload is highly evasive, featuring a Microsoft-attested kernel driver that had zero detections on VirusTotal at the time of discovery.

Technically, the campaign is notable for its use of the Cruciferra crypter and its ability to bypass advanced security controls. The primary malicious component, Alinubx.sys, is a renamed version of the CcProtect driver that terminates 145 different antivirus and EDR processes from kernel mode. Once defenses are neutralized, the Rapuncel stealer exfiltrates browser credentials, cryptocurrency wallets, session tokens (Discord, Steam, Telegram), and sensitive documents to an attacker-controlled C2 server.

This campaign highlights the extreme risks of Bring Your Own Vulnerable Driver (BYOVD) attacks and the limitations of signature-based trust models. Since the driver is Microsoft-signed, it bypasses standard user-mode protections like Protected Process Light (PPL). Organizations should monitor for the specific driver behaviors and indicators of the Cruciferra toolset, as the infrastructure is highly automated and easily redeployed.