Rapuncel Infostealer Campaign Impersonates Software Brands

Since at least August 2026, threat actors have conducted a broad brand-impersonation campaign using SEO-poisoning techniques on GitHub to distribute fake software installers, including fraudulent LastPass Authenticator and macOS LastPass applications. The campaign, which targets at least 40 organizations, relies on a complex redirect chain involving GitHub and Cloudflare to deliver malicious archives. Upon execution, the installer uses a side-loaded DLL to deploy a Microsoft-attested kernel driver disguised as an NVIDIA component. This driver is designed to terminate 145 different endpoint security and antivirus products. Once security defenses are neutralized, the 'Rapuncel' stealer module installs itself as a persistent Windows service to harvest browser credentials, cryptocurrency wallets, messaging tokens, and system profile data. Researchers have identified links between this campaign's DLL loaders and the Cruciferra crypter service, as well as behavioral overlaps with the BoryptGrab infostealer.

Attack Chain

1. The victim performs a search engine query and navigates to an SEO-poisoned GitHub repository masquerading as a legitimate software provider.
2. The victim clicks a download link that traverses a hidden routing chain via multiple GitHub pages and a Cloudflare-fronted server.
3. The victim downloads a malicious archive containing a fake installer and a companion DLL, which acts as a side-loader for malicious code.
4. The installer executes a renamed legitimate debugging tool, which triggers the side-loading of the companion DLL into memory.
5. The attacker's code loads a Microsoft-attested kernel driver that hides itself and attempts to terminate 145 predefined security and antivirus processes.
6. The malware installs itself as a Windows service to ensure persistence across system reboots.
7. The Rapuncel module scans the file system for sensitive data, including cryptocurrency wallets, browser-stored passwords, and messaging tokens.
8. Captured data and system profiles are exfiltrated to the attacker's infrastructure while the service remains active to monitor and re-kill any restarted security tools.

Impact

This campaign poses a severe risk to corporate and personal data by disabling endpoint security protections to facilitate long-term unauthorized access. By targeting 40+ brands and 145 security products, the attackers aim to harvest high-value credentials, cryptocurrency, and session tokens from a wide victim base. Successful infection results in total system compromise, where the machine remains under attacker control until the kernel-level driver is manually removed.

Recommendation

Prioritize detection and response efforts to identify unauthorized kernel driver loads and persistent service creation associated with this campaign.

• Monitor endpoint logs for the installation of unsigned or suspiciously named kernel drivers, particularly those attempting to spoof NVIDIA-related file paths.
• Enable Sysmon or equivalent EDR telemetry to detect the execution of renamed debugging tools (e.g., binaries performing DLL side-loading).
• Inspect GitHub-sourced software downloads for unauthorized or misaligned branding, especially when hosted outside of official vendor domains.
• Deploy detection rules to identify new Windows services that lack verifiable developer signatures or that exhibit suspicious file paths in the ImagePath property.