Fake GitHub Repos for LastPass and 39 Other Brands Are Pushing Malware That Kills 145 Security Tools

A driver Microsoft already signed once got signed again under a new name

LastPass and threat intelligence firm Delphos Labs disclosed a malware campaign on September 17, 2026, that has been running since at least August 13. The target: anyone searching for LastPass Authenticator or one of at least 39 other software brands, according to both LastPass and Bleeping Computer.

The attackers built SEO-optimized fake GitHub repositories, complete with logos, README files, and inflated star counts, designed to rank near the top of search results, according to CyberNewsAI's reporting on the campaign. Click the download link and you get routed through several redirects before landing on a ZIP file bloated to between 128MB and 148MB, according to Bleeping Computer. That size isn't an accident. It's built to exceed the file-size limits that many automated security scanners use to skip scanning large files.

Inside the ZIP is a renamed copy of a legitimate Microsoft tool, the Visual Studio CoreCLR Debugger (vsdbg.exe), reconfigured to sideload a malicious DLL, according to Bleeping Computer and We Fix PC. That DLL drops two things: the Rapuncel infostealer itself, and a kernel driver called Alinubx.sys, disguised as an Nvidia component named nvfsflt64.sys.

How a kernel driver kills 145 security products at once

The driver is where this campaign gets structurally serious. Alinubx.sys carries a hardcoded list of 145 antivirus and endpoint detection and response (EDR) processes and terminates them from kernel mode, according to LastPass, as quoted by Bleeping Computer. It does this by calling a Windows function, ObOpenObjectByPointer, with kernel-mode access rights that skip the normal security check most processes go through when something tries to open or kill them.

This bypasses Protected Process Light, or PPL, the Windows 8.1-era protection that most antivirus vendors rely on to survive being shut down by an administrator or malicious code, according to LastPass. Once PPL is defeated, security software just dies, with no alert and no crash log a typical user would notice.

According to Tech Times, the driver isn't actually new code. It's a renamed version of a driver originally built by a Chinese disk-encryption company, one that security researchers had already flagged with public proof-of-concept kill code and listed on the LOLDrivers community registry of known-dangerous drivers. Tech Times reports the operators changed the filename, which generated a new file hash, and resubmitted it through Microsoft's Windows Hardware Compatibility Publisher signing program. The new hash didn't match Microsoft's vulnerable driver blocklist. Tech Times reports it also came back clean across 72 VirusTotal antivirus engines.

If that reporting holds up, it means a driver already publicly documented as dangerous got a fresh Microsoft signature simply by changing its name. Microsoft has not issued a public statement addressing that specific claim in the material reviewed for this story, and no CVE or blocklist update tied to Alinubx.sys had been confirmed as of these reports.

What Rapuncel actually steals

Once the security tools are dead, Rapuncel gets to work. According to Bleeping Computer and daily.dev, it pulls credentials from 25 browsers, data from 30 cryptocurrency wallets, session tokens from Discord, Steam, and Telegram, the contents of Windows Credential Manager, documents containing words like "password," "seed," "wallet," or "recovery," screenshots from every connected monitor, and detailed system information.

To get past Google's app-bound encryption on Chrome and Edge, Rapuncel injects a helper DLL into the browser and invokes its own elevation service, according to Bleeping Computer. Stolen data gets compressed and sent to an external server at 2.26.126[.]50 using a raw TCP connection formatted to look like ordinary HTTP traffic. The malware installs itself as a Windows service, so a reboot doesn't fix anything. It just re-kills whatever security software comes back up before Rapuncel restarts.

LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of an existing stealer called BoryptGrab, built using a crypter tool called Cruciferra PUROSANGUE, according to Bleeping Computer and the Radar threat intelligence platform.

The driver signing gap

Microsoft's driver signing program exists precisely to let legitimate hardware vendors get their drivers trusted by Windows, and the volume of legitimate submissions is enormous. A reasonable argument holds that catching every renamed resubmission of a previously flagged driver requires manual review that doesn't scale, and that blocklists are inherently reactive by design.

But the gap is still the gap. A driver with known kill code, already sitting on a public registry, walked through the certification pipeline a second time and came out clean. No patch exists yet for this specific driver or for Rapuncel, according to the Radar/OffSeq threat intelligence writeup. Its mitigation advice is blunt: don't download software from unofficial GitHub repos, don't trust search-result rankings as a proxy for legitimacy, and block known indicators where you can.

Whether Microsoft updates its vulnerable driver blocklist to catch Alinubx.sys specifically and whether its signing program changes anything about how resubmitted drivers get vetted going forward remains to be seen. Neither has been confirmed as of these reports.