Rapuncel campaign used fake GitHub repos and a Microsoft-signed driver to disable EDR at 40 firms

How the lure works

According to research from Delphos Labs, summarized in a dev.to threat intelligence write-up, a malware-as-a-service operation known as Rapuncel built its distribution channel out of counterfeit GitHub repositories styled to look like they belonged to at least 40 real companies. Victims typically arrive by searching for popular software and clicking links that have been pushed up search rankings. The fake pages borrow corporate branding and even display a fabricated VirusTotal approval notice to appear vetted.

The payload ships as a ZIP archive deliberately inflated to 127–148 MB. Delivery leans on GitHub Pages 404 handling plus a chain of dynamic redirects hosted behind Cloudflare, which makes the download look like ordinary traffic. BleepingComputer also covered the campaign.

From fake installer to SYSTEM

Unzipping and running the installer triggers a classic side-loading trick: a rogue vsdbg.dll placed next to the genuine, signed vsdbg.exe, a Visual Studio debugger component, gets loaded in its place. The injected code then climbs from the user's session to SYSTEM privileges using several UAC elevation techniques, which clears the way for kernel-level components.

A Microsoft-signed driver turned against defenders

The signature piece of the kit is a kernel driver the researchers call Alinubx.sys, dropped as nvfsflt64.sys under C:\Windows\System32\drivers with an NVIDIA-flavored name and registered as the NvFsFilter service so it survives reboots. Crucially, it carries a Microsoft Windows Hardware Compatibility Publisher signature, so Windows treats it as legitimate. From kernel mode it terminates any process whose name matches a built-in list of 145 antivirus and EDR product names. The researchers flag creation of the \.\Alinubx device as one of the highest-priority signals for defenders.

What the stealer takes

Once security tools are down, the Rapuncel payload harvests credentials and session material from more than 25 browsers and over 30 cryptocurrency wallets, along with Discord, Steam, Telegram and Windows Credential Manager data. Saved browser passwords are decrypted by sidestepping App-Bound Encryption, and screenshots, documents and system information round out the haul. Exfiltration runs to 2.26.126[.]50 over raw TCP in an HTTP-style format. LastPass and Delphos Labs both analyzed samples and confirmed the chain end to end; the total number of infected endpoints has not been made public.

Detection and mitigation

For administrators, the campaign leaves recognizable traces: an unexpected DLL sitting beside vsdbg.exe, driver deployment, the NvFsFilter service, and a burst of security-process terminations. The report recommends correlating a web search with a large ZIP download, vsdbg.exe launching, UAC elevation, EDR terminations and outbound transfer, and hunting for portable executables with unusually large .reloc sections or renamed drivers from the same signing family. Because the malware assumes it can silence endpoint agents, DNS, proxy and Windows event logs should be shipped off-host in near real time. Priority mitigations include restricting software installs to official distribution channels, application control such as WDAC, and blocking known vulnerable or abused drivers. The activity maps to masquerading, DLL side-loading, impairing defenses and credential theft in the MITRE ATT&CK framework.

Why it matters

This campaign is a supply-chain problem in a new place: it does not compromise a vendor's build, it counterfeits the vendor's presence on a platform people already trust, then games search engines to close the loop. The Microsoft compatibility signature on the driver shows that driver-signing trust remains a workable weapon, since a valid signature was enough to let an EDR-killing component load. And because the kit is sold as a service and re-skinned for dozens of brands at once, one actor's infrastructure can reach victims across many unrelated organizations simultaneously, lowering the cost of attack while multiplying the burden on defenders.