Overview
- Security teams discovered SEO‑poisoned GitHub pages that lured users to download a fake LastPass Authenticator in August and published a joint technical analysis in mid‑September.
- The attack chain delivered a large, padded ZIP that contained a renamed Microsoft debugging exe and a malicious vsdbg.dll that was DLL‑side‑loaded to gain SYSTEM privileges.
- The payload installed a Microsoft‑attested kernel driver (observed as Alinubx.sys) that kills 145 named antivirus and EDR processes from kernel space and was clean on VirusTotal and not on Microsoft’s blocklist at report time.
- The information stealer tracked as Rapuncel harvested saved passwords from more than 25 browsers, crypto wallet files from about 30 apps, Discord/Steam/Telegram tokens, Windows Credential Manager data, screenshots, and persisted across reboots.
- Researchers warn this is a classic bring‑your‑own‑vulnerable‑driver abuse using renaming and archive padding to evade hash and size checks, so defenders should treat affected hosts as kernel‑level compromises, rebuild from clean media, rotate credentials from a clean device, and hunt for behavior rather than single file hashes.