A Sophisticated Malware Campaign Exploits GitHub Repositories to Bypass Security Measures and Steal Sensitive Data
A complex and highly organized malware campaign has been uncovered, utilizing fake GitHub repositories to impersonate well-known software firms and push a previously unknown information stealer called Rapuncel. This campaign not only steals sensitive data from infected devices but also disables security measures by killing antivirus software.
The attackers have set up fake GitHub repositories that are optimized for search engine results, making it likely for victims to stumble upon these malicious links while searching for legitimate software such as LastPass Authenticator. Once clicked, the download process triggers a series of redirections before reaching payload-delivery servers, where victims receive large ZIP archives containing their downloaded software.
However, instead of the expected software, the archive contains a modified version of Microsoft’s Visual Studio CoreCLR Debugger installer, which is configured to sideload a malicious DLL (vsdbg.dll). This DLL deploys both the Rapuncel infostealer and an NVIDIA component-named kernel driver disguised as ‘nvfsflt64.sys’ that registers as the NvFsFilter service.
The kernel driver acts as an EDR killer, containing a hardcoded list of 145 antivirus and EDR processes it aims to terminate. The researchers have noted that this driver bypasses normal user-mode security checks by opening the process in kernel mode and killing it, allowing it to defeat Protected Process Light (PPL) protection relied upon by many security products.
Moreover, Alinubx.sys contains additional capabilities for file and registry hiding, DLL injection, driver and process interception, traffic manipulation, and port redirection. Although these features appear not to be activated in this campaign, they highlight the full extent of the attackers’ toolkit.
Once antivirus software is terminated on the device, the Rapuncel infostealer begins collecting sensitive information from the infected device. This includes credentials stored in 25 web browsers, data from 30 cryptocurrency wallets, session credentials for Discord, Steam, and Telegram, Windows Credential Manager contents, documents containing specific keywords, screenshots from connected monitors, and detailed system information.
To bypass Google’s app-bound encryption protection present on Chrome and Edge, Rapuncel injects a helper DLL into the app and invokes its own Elevation Service. The stolen information is then compressed and uploaded to an external endpoint using HTTP-formatted requests sent over raw TCP.
The researchers have assessed with moderate confidence that Rapuncel is a variant of BoryptGrab, while also finding that its loader was built with the Cruciferra PUROSANGUE crypter. Given the sophistication of this campaign, it’s crucial for users to exercise caution when downloading software and be wary of fake repositories.
To stay safe, users are recommended to only download software from official websites, avoid dubious GitHub repositories, and skip or block promoted results on Google Search.
Source: Bleeping Computer — 2026-09-18