INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Use Signed Driver to Disable 145 Security Tools

| 2026-09-21 11:55 LOW HIGH DATA BREACH MALWARE & BOTNETS CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
On September 22, 2026, a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub was identified and disrupted by Team in partnership with Delphos. The affected entities include LastPass and at least 39 other organizations. The payload delivered survived controls built to stop it, featuring a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score. The attack works by tricking victims into downloading fake GitHub repositories impersonating well-known software firms, which then redirects them to payload-delivery servers containing ZIP archives with inflated sizes to evade security scans. As of the current status, no further information is available on the incident's resolution or ongoing impact.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 21 IoCs Create Free Account
al•••••.sys
ic•••••.com
al•••••.com
is•••••.com
vs•••••.dll
vs•••••.exe
2.26.•••.•••
26db14••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
aefbc6••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
ea8c31••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
75018b••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
020f09••••••••••••••••••••••••••
0b43cb••••••••••••••••••••••••••
10b304••••••••••••••••••••••••••
4a7c94••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope mediamedia technologytechnology
Incident Timeline
‎2026/09/21
Threat actors used a Microsoft-signed kernel driver to disable 145 security tools and steal passwords, disguising it as an NVIDIA component.
organisation Microsoft
Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords.
Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.
organisation EDR
Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.
infrastructure Windows
The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
" Currently, the driver is not in Microsoft's vulnerable drivers blocklist, and the one used in the campaign is signed through Microsoft's Windows Hardware Compatibility Publisher chain.
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound e…
Rapuncel persists across reboots via a Windows service, so any security tools that reactivate are killed again before the infostealer launches.
organisation Microsoft Windows
The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
organisation VirusTotal
The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
organisation Discord, Steam
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound e…
organisation Telegram
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound e…
organisation GitHub
Team, in partnership with Delphos, identified and disrupted a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub.
organisation LastPass
LastPass is internally tracking the infostealer as Rapuncel. References: hxxps://blog[.]lastpass[.]com/posts/lastpass-delphos-report-rapuncel-infostealer Indicators of compromise:
LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.
organisation Rapuncel
LastPass is internally tracking the infostealer as Rapuncel. References: hxxps://blog[.]lastpass[.]com/posts/lastpass-delphos-report-rapuncel-infostealer Indicators of compromise:
The installer deploys the Rapuncel infostealer as well as the Alinubx.sys kernel driver, which is used to kill antivirus software.
organisation Alinubx.sys
The installer deploys the Rapuncel infostealer as well as the Alinubx.sys kernel driver, which is used to kill antivirus software.
organisation Microsoft Visual Studio CoreCLR Debugger
The installer inside the archives is a copy of the legitimate Microsoft Visual Studio CoreCLR Debugger, 'vsdbg.exe,'  renamed and configured to sideload a malicious DLL (vsdbg.dll).
organisation DLL
The installer inside the archives is a copy of the legitimate Microsoft Visual Studio CoreCLR Debugger, 'vsdbg.exe,'  renamed and configured to sideload a malicious DLL (vsdbg.dll).
organisation NvFsFilter
Malicious GitHub page Source: LastPass The kernel driver is disguised as an NVIDIA component named 'nvfsflt64.sys' and registers as the NvFsFilter service.
organisation Screenshots
…rom 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound encryption protection present on Chrome, Edge, and related browsers, Rapuncel injects a helper DL…
organisation Google
…elegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound encryption protection present on Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the app and invokes its own Elevation Service.
organisation Chrome, Edge
…elegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound encryption protection present on Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the app and invokes its own Elevation Service.
organisation Elevation Service
…elegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound encryption protection present on Chrome, Edge, and related browsers, Rapuncel injects a helper DLL into the app and invokes its own Elevation Service.
data_breach 25 browsers Data
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound en…
organisation LastPass Authenticator
The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.
organisation AccessMode
"The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time," explains LastPass .
organisation KernelMode
"The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode SeAccessCheck path at handle-open time," explains LastPass .
organisation TCP
The stolen information is compressed and uploaded to an external endpoint at ' 2.26.126[.]50 ' using an HTTP-formatted request sent over raw TCP.
organisation BoryptGrab
LastPass and Delphos Labs assessed with moderate confidence that Rapuncel is a variant of BoryptGrab, while they also found that its loader was built with the Cruciferra PUROSANGUE crypter.
organisation Google Search
Users are recommended to only download software from official websites, avoid dubious GitHub repositories, and skip or block promoted results on Google Search.
organisation NFL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
organisation CHANEL
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
data_breach 148 MB
There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score.
" Currently, the driver is not in Microsoft's vulnerable drivers blocklist, and the one used in the campaign is signed through Microsoft's Windows Hardware Compatibility Publisher chain.
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound e…
Rapuncel persists across reboots via a Windows service, so any security tools that reactivate are killed again before the infostealer launches.
Metrics
data_breach
25
Browsers Data
The malware collects the following information: Credentials stored in 25 web browsers Data from 30 cryptocurrency wallets Discord, Steam, and Telegram session credentials Windows Credential Manager contents Documents with names containing "password," "seed," "wallet," or "recovery" Screenshots from every connected monitor Detailed system information To bypass Google's app-bound en…
Metrics
data_breach
148
Mb
There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans.
Intelligence Sources
BleepingComputer 2026-09-18
AlienVault OTX 2026-09-22
AlienVault OTX 2026-09-21