Attack Chain

1. The victim performs a search engine query and navigates to an SEO-poisoned GitHub repository masquerading as a legitimate software provider.
2. The victim clicks a download link that traverses a hidden routing chain via multiple GitHub pages and a Cloudflare-fronted server.
3. The victim downloads a malicious archive containing a fake installer and a companion DLL, which acts as a side-loader for malicious code.
4. The installer executes a renamed legitimate debugging tool, which triggers the side-loading of the companion DLL into memory.
5. The attacker's code loads a Microsoft-attested kernel driver that hides itself and attempts to terminate 145 predefined security and antivirus processes.
6. The malware installs itself as a Windows service to ensure persistence across system reboots.
7. The Rapuncel module scans the file system for sensitive data, including cryptocurrency wallets, browser-stored passwords, and messaging tokens.
8. Captured data and system profiles are exfiltrated to the attacker's infrastructure while the service remains active to monitor and re-kill any restarted security tools.

Impact

This campaign poses a severe risk to corporate and personal data by disabling endpoint security protections to facilitate long-term unauthorized access. By targeting 40+ brands and 145 security products, the attackers aim to harvest high-value credentials, cryptocurrency, and session tokens from a wide victim base. Successful infection results in total system compromise, where the machine remains under attacker control until the kernel-level driver is manually removed.

Recommendation

Prioritize detection and response efforts to identify unauthorized kernel driver loads and persistent service creation associated with this campaign.

• Monitor endpoint logs for the installation of unsigned or suspiciously named kernel drivers, particularly those attempting to spoof NVIDIA-related file paths.
• Enable Sysmon or equivalent EDR telemetry to detect the execution of renamed debugging tools (e.g., binaries performing DLL side-loading).
• Inspect GitHub-sourced software downloads for unauthorized or misaligned branding, especially when hosted outside of official vendor domains.
• Deploy detection rules to identify new Windows services that lack verifiable developer signatures or that exhibit suspicious file paths in the ImagePath property.