Rapuncel Infostealer Used Fake GitHub Pages to Target 40+ Brands

Rapuncel Campaign Turned GitHub Into a Malware Distribution Network

A new investigation from LastPass Threat Intelligence, Mitigation, and Escalation (TIME) and Delphos Labs has uncovered a multi-stage malware campaign that used fraudulent GitHub organizations and GitHub Pages to distribute an infostealer.

The campaign impersonated at least 40 companies, with LastPass Authenticator among the brands used in the observed lures. Researchers identified the activity on August 13, 2026, after finding a fraudulent GitHub organization presenting itself as an official LastPass Authenticator source.

The investigation found that the malware, internally tracked by LastPass as Rapuncel, was delivered alongside a Microsoft-attested kernel driver called Alinubx.sys. The driver was designed to terminate security software processes from kernel mode.

Importantly, LastPass said that no LastPass system, service, or customer vault was compromised. The campaign used LastPass branding outside official LastPass distribution channels.

The investigation was based on observations through September 10, 2026. LastPass also cautioned that threat infrastructure can change rapidly, meaning domains, payload servers and lure pages may no longer behave exactly as documented.

How the Attack Started With a Fake GitHub Page

The campaign relied heavily on search visibility.

A user searching for something such as "LastPass Authenticator download" could encounter a fraudulent GitHub organization designed to resemble a legitimate LastPass product page.

The fake page used LastPass branding, logos and product descriptions and displayed a prominent download button.

Researchers also identified another GitHub page impersonating a macOS LastPass product. LastPass assessed that the pages were probably operated by the same actor, although the second site had already been taken down when investigators attempted to examine it.

This approach is significant because the initial compromise did not require the victim to visit an obviously malicious domain. Instead, the attacker attempted to make the malicious download appear to be the answer to a legitimate software search.

The Fake Download Portal Added Fake Trust Signals

After clicking the download button, victims were redirected to a GitHub Pages site designed to look like a legitimate software download portal.

The page displayed fabricated security indicators including:

• "Authorized Access"

• "VirusTotal Approved"

• "Secure Archive"

It also displayed a loading animation suggesting that the site was validating the session and generating a secure download token.

According to LastPass, these indicators were not legitimate security approvals. They were simply visual elements intended to increase the victim's confidence in the download.

This is an important part of the campaign's social engineering strategy. The malware did not depend solely on technical exploitation. It first attempted to establish enough trust for the user to voluntarily download and execute the file.

Hidden GitHub Redirects Obscured the Malware Infrastructure

The download portal was only one part of the infrastructure.

Researchers found multiple GitHub Pages accounts operating as hidden redirect points. The pages used custom 404.html files containing JavaScript that captured URL paths and redirected visitors to another stage.

The user would not necessarily see anything suspicious because the redirect pages were designed to look like ordinary missing-page responses.

A separate Cloudflare-fronted domain acted as a traffic director. According to the investigation, the malicious infrastructure could retrieve the current payload destination dynamically instead of placing the final server directly inside every lure page.

This architecture provided operational flexibility. If an attacker needed to change the payload server, the redirect infrastructure could be updated without rebuilding every fake GitHub page.

One Malware Kit Was Used Against Dozens of Brands

The investigation found that albinofennel.com was serving at least 40 other branded impersonation pages.

This suggests that the LastPass lure was not an isolated operation. Instead, it was one example of a broader malware distribution system capable of changing the brand presented to victims.

The campaign used different tracking codes in download URLs, indicating that the infrastructure supported multiple lure campaigns or distribution channels.

Researchers also observed large ZIP files containing the malware. Two examples were approximately 148 MB and 127.9 MB.

The large file sizes were intentional. According to Delphos, the attackers used junk files to inflate the archive, potentially causing automated security scanners with file-size limitations to skip deeper inspection.

The Malware Hid Inside a Fake Installer

Once the victim opened the ZIP file, the attack moved from social engineering to execution.

The apparent installer was actually Microsoft's vsdbg.exe debugging tool renamed by the attackers.

Windows normally loads a companion DLL from the same directory in this type of execution flow. The attackers abused this behavior so that the legitimate-looking executable loaded a malicious vsdbg.dll.

The DLL served as the loader for the next stages of the infection.

This is an example of DLL side-loading, where attackers place a malicious DLL beside a legitimate executable and rely on normal application loading behavior to execute their code.

The Kernel Driver Was Designed to Disable Security Software

One of the most important components discovered by researchers was Alinubx.sys.

The driver operated at the Windows kernel level and contained a list of 145 antivirus and endpoint security process names.

The malware used the driver to terminate security processes from kernel mode.

The driver was dropped under:

C:\Windows\System32\drivers\nvfsflt64.sys

and registered using the service name:

NvFsFilter

It was disguised as an NVIDIA-related file system filter driver.

According to the investigation, the driver exposed an IOCTL interface and accepted process IDs that it could terminate using kernel-level operations. This allowed it to interfere with security products that would normally be protected from ordinary user-mode process termination.

A Microsoft-Attested Driver Still Passed Through Trust Controls

The driver presented another major problem for conventional detection.

LastPass and Delphos reported that Alinubx.sys had a Microsoft Windows Hardware Compatibility Publisher chain signature.

The investigation also found that the driver was not present in Microsoft's vulnerable driver blocklist at the time of publication.

This allowed the malware to take advantage of an important trust assumption: a digitally signed driver can appear more trustworthy to operating system security mechanisms than an unsigned malicious file.

Researchers also found that Alinubx.sys was closely related to CcProtect.sys, a driver associated with the CnCrypt product line.

The investigation found matching product information, version information, submitter information and the same process-killing primitive, while the malicious sample used a different driver identity and filename.

The key distinction is important:

A valid digital signature establishes that software passed through a signing or trust process. It does not establish that the software is safe in every context.

Rapuncel Targets Passwords, Wallets and Session Data

After security software was disabled, Rapuncel could begin collecting information from the infected system.

The investigation found that the stealer targeted more than 25 browsers in the observed deployment.

It also attempted to collect:

• Browser-stored credentials

• Cryptocurrency wallet files

• Discord login tokens

• Steam session information

• Telegram session data

• Windows Credential Manager information

• Documents with names containing terms such as password, seed, wallet or recovery

• Screenshots

• System information

The malware also contained a browser injection component designed to work against Chrome and Edge protections involving app-bound encryption. Researchers found that the component could inject code into the browser process and use the browser's own decryption service.

This means the campaign was not simply attempting to steal a single browser password database. Its collection process covered several categories of credentials, authentication material and sensitive local information.

Stolen Data Was Packaged and Exfiltrated

Rapuncel compressed collected information into a ZIP archive before sending it to attacker-controlled infrastructure.

The investigation identified:

2.26.126[.]50

as the observed exfiltration endpoint.

The malware used a raw TCP connection formatted to resemble ordinary HTTP traffic and attempted the upload again if the first attempt failed.

LastPass and Delphos noted that the delivery infrastructure and Alinubx driver did not communicate with external infrastructure in this deployment. The dedicated C2 was used for Rapuncel credential-data exfiltration.

Some Capabilities Were Present but Not Activated

The investigation also distinguished between capabilities found inside the driver and capabilities actually observed during this deployment.

Alinubx.sys contained functionality associated with:

• File and registry hiding

• Process and driver interception

• DLL interception

• Network control

• Port redirection

• Windows Filtering Platform traffic handling

• APC-based DLL injection

• Configuration-driven behavior

However, researchers did not find evidence that several of these capabilities were activated in the analyzed deployment.

For example, the expected Alinubx.ccf configuration file was not present, and investigators found no evidence that the network redirect or ProtectR3.dll injection functionality was activated.

This distinction matters because the presence of code does not necessarily mean that every capability was executed during the observed attack.

Rapuncel May Be Related to the BoryptGrab Ecosystem

The investigation also examined possible connections between Rapuncel and the BoryptGrab campaign documented by Trend Micro in March 2026.

Researchers identified several overlaps, including:

• SEO-optimized fake GitHub repositories

• GitHub Pages download portals

• Dynamic payload redirection

• Similar data collection artifacts

• Telegram, Discord and Steam collection

• Cryptocurrency wallet theft

• Browser credential theft

• Chrome and Edge app-bound encryption bypass techniques

• Large ZIP archives containing padding

However, the samples were not identical.

They had different hashes, different build names and different C2 infrastructure. Delphos therefore assessed Rapuncel as a BoryptGrab-related variant or sibling build, rather than a confirmed match to a previously documented BoryptGrab sample.

The report also states that there was no definitive evidence that Rapuncel was AI-generated.

Delphos Linked the Loader to Cruciferra's PUROSANGUE

Another major finding involved the loader itself.

Delphos assessed with high confidence that vsdbg.dll was produced by the Cruciferra PUROSANGUE crypter package or a close derivative.

Researchers identified similarities involving payload storage, custom encoding, DLL side-loading, UAC bypass, persistence and endpoint-security tampering.

The analysis also found the string:

C:\ExploitTests\purosangue.tx

inside the loader.

The report notes that the sample differed from previously documented Cruciferra implementations in some areas, including its use of .NET NativeAOT and a different driver. These differences were not considered sufficient to rule out the assessed lineage.

Why Traditional Signature Detection Was Not Enough

The campaign demonstrates a problem with relying exclusively on known hashes, filenames and blocklists.

The driver was reportedly signed, had previously produced a clean VirusTotal result during the investigation window, and was not present in Microsoft's vulnerable driver blocklist at publication.

Changing the filename of a known driver can also produce a different hash, which means hash-based detection may not automatically recognize the relationship.

Delphos therefore analyzed the compiled binary directly using techniques including static analysis, custom decryption, NativeAOT data reconstruction and emulator-assisted inspection.

What Defenders Should Hunt For

LastPass and Delphos recommend focusing on behavior and lineage rather than relying only on original filenames.

Relevant hunting opportunities identified in the report include:

C:\Windows\System32\drivers\nvfsflt64.sys

NvFsFilter

\\.\Alinubx

\SystemRoot\Alinubx.ccf

Security teams can also investigate Microsoft-attested drivers associated with the Henan Dafeng Software Co., Ltd. identity or CnCrypt-related version information.

Other behavioral indicators include a driver loading followed by termination of security processes, suspicious vsdbg.exe child processes, and PE files containing unusually large .reloc sections with the characteristics described by Delphos.

The report specifically cautions that the identified IP address should be treated as historical infrastructure context rather than used as a standalone block rule.

Key Indicators of Compromise

The investigation published several hashes associated with the campaign.

These values are reproduced from the LastPass and Delphos investigation and should be treated as threat-intelligence indicators rather than assumptions that they represent the complete campaign.

What Victims Should Do

The report recommends treating credentials stored on an affected machine as exposed.

This includes browser credentials, cryptocurrency wallet information, Discord and Steam credentials, Telegram session information and Windows Credential Manager data.

LastPass recommends changing credentials from a separate, known-clean device and reviewing account or vault activity for unexpected changes.

Because the malware installed a kernel driver designed to interfere with security tools, the report also highlights the need for deeper investigation when a machine has actually executed the malicious payload.

The Bigger Cybersecurity Lesson

The Rapuncel campaign illustrates how attackers can combine social engineering, legitimate infrastructure and low-level Windows components into a single delivery chain.

The attack did not rely on one technique.

Instead, it combined:

SEO manipulation → fake GitHub identity → GitHub Pages → hidden redirects → oversized ZIP → DLL side-loading → privilege escalation → signed kernel driver → security-process termination → credential theft → data exfiltration

This layered approach makes the campaign particularly relevant to defenders because blocking one indicator may not stop the broader infrastructure.

For enterprises, the investigation highlights the importance of validating software sources, monitoring unusual driver installations, inspecting signed binaries based on behavior and investigating relationships between seemingly unrelated artifacts.

The broader industry shift is toward detection methods that combine identity, behavior, binary characteristics and execution context rather than relying on a single trust signal.

Final Thoughts

The LastPass and Delphos investigation shows how a recognizable software brand can be abused to make a malicious download appear legitimate.

The campaign's use of GitHub for impersonation, dynamic redirects, oversized archives and a Microsoft-attested kernel driver demonstrates how multiple trust mechanisms can be chained together.

Rapuncel's primary objective in the observed deployment was credential and sensitive-data theft, while Alinubx.sys provided the capability to disable endpoint security products at kernel level.

For defenders, the most important takeaway is not a single domain, hash or filename. It is the need to correlate execution behavior, driver lineage, persistence mechanisms, security-process termination and credential-access activity.

The infrastructure described in the report may change, but the behavioral patterns provide more durable signals for investigation and detection.