Executive Summary
In September 2026, threat actors deployed a sophisticated infostealer campaign using a fake LastPass Authenticator installer hosted on GitHub. The malicious package leveraged DLL side-loading techniques and a Microsoft-signed kernel driver (Alinubx.sys) to disable antivirus and EDR solutions before deploying the Rapunzel infostealer. The attack targeted saved passwords from over 24 browsers, cryptocurrency wallets, and credentials from Discord, Steam, and Telegram, exploiting Google's app-bound encryption through browser injection techniques. The campaign demonstrated advanced evasion by using a legitimately signed but vulnerable driver from CnCrypt, renamed to avoid detection, and successfully bypassed Microsoft's vulnerable driver blocklist due to hash-based matching limitations.
Why This Matters Now
This incident highlights the evolving sophistication of infostealer campaigns that abuse legitimate Microsoft-signed drivers to bypass modern security controls, demonstrating critical gaps in driver validation processes and the urgent need for behavioral-based detection mechanisms.
Attack Path Analysis
Attackers used fake LastPass Authenticator GitHub pages to distribute malicious installers via DLL side-loading, escalated to SYSTEM privileges using a Microsoft-signed vulnerable driver to terminate security software, maintained persistence through service installation, established command channels for data collection, exfiltrated credentials and sensitive files to attacker-controlled servers, and achieved sustained system compromise with disabled security controls.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Victims downloaded fake LastPass Authenticator installer from malicious GitHub repository through search engine optimization, executing DLL side-loading attack via renamed vsdbg.exe and malicious vsdbg.dll
MITRE ATT&CK® Techniques
Spearphishing Attachment
DLL Side-Loading
Process Injection
Disable or Modify Tools
Windows Service
Credentials from Web Browsers
Private Keys
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Authentication Data Protection
Control ID: 6.4.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – ICT Risk Management
Control ID: Article 8
CISA ZTMM 2.0 – Device Trust and Security
Control ID: Function 4.2
NIS2 Directive – Incident Response and Crisis Management
Control ID: Article 21.2(a)
ISO 27001:2022 – Use of Cryptography
Control ID: A.8.24
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical exposure to credential theft targeting banking passwords, cryptocurrency wallets, and encrypted payment data through kernel-level EDR bypass techniques.
Computer Software/Engineering
High risk from fake GitHub repositories targeting developers with malicious installers that disable security tools and steal authentication credentials.
Information Technology/IT
Severe impact from kernel driver abuse bypassing endpoint security, compromising administrator credentials and violating zero trust network segmentation controls.
Gaming/Casinos
Targeted credential theft of Steam gaming sessions and Discord communications, with payment data exfiltration bypassing traditional security monitoring capabilities.
Sources
- Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDRhttps://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.htmlVerified
- LastPass and Delphos Labs Joint Report on Rapuncel Infostealerhttps://blog.lastpass.com/posts/lastpass-delphos-report-rapuncel-infostealerVerified
- LOLDrivers - CcProtect.sys Driver Catalog Entryhttps://www.loldrivers.io/drivers/3e3067b0-3d74-46fe-9f57-1ae3a0293958/Verified
- Microsoft Recommended Driver Block Rules Documentationhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rulesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this Rapuncel infostealer attack by limiting network reachability and segmenting compromised workloads from critical assets. While the initial DLL side-loading compromise could occur, Zero Trust segmentation would reduce lateral movement scope and limit data exfiltration paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The initial compromise through malicious installer download would likely still occur, but CNSF visibility would detect the DLL side-loading behavior and provide early warning signals of suspicious process execution patterns.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely limit the scope of SYSTEM-level access by restricting network reachability from the compromised workload, constraining attacker ability to access sensitive network segments even with elevated privileges.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain lateral movement attempts by blocking unauthorized network communications between compromised and adjacent workloads, reducing the attacker's ability to discover and access additional systems.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility would likely detect and log the persistent C2 communications, providing network administrators with detailed traffic analysis and enabling potential blocking of attacker command channels.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely constrain data exfiltration by blocking unauthorized outbound transfers of ZIP files to attacker servers, reducing the volume of sensitive credentials and wallet data successfully transmitted.
The compromised endpoint would likely remain isolated within its network segment, constraining the blast radius to the single workload rather than enabling enterprise-wide credential theft and system compromise.
Impact at a Glance
Affected Business Functions
- Endpoint Security Operations
- Identity and Access Management
- Cryptocurrency Asset Management
- Password Management Systems
Estimated downtime: 3 days
Estimated loss: $25,000
Saved browser passwords from 25+ browsers, cryptocurrency wallet files, Discord/Steam/Telegram login sessions, Windows Credential Manager contents, and files containing passwords, seed phrases, or recovery keys. Chrome and Edge passwords decrypted via browser service injection.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Inline IPS (Suricata) to detect and block known malicious payloads and exploit patterns during initial compromise attempts
- • Deploy Egress Security & Policy Enforcement to prevent unauthorized data exfiltration to attacker-controlled domains and detect suspicious outbound traffic patterns
- • Establish Zero Trust Segmentation with least privilege principles to limit the impact of compromised endpoints and prevent lateral movement to critical assets
- • Enable Multicloud Visibility & Control to detect anomalous interactions, suspicious automation patterns, and driver installation activities across hybrid environments
- • Configure Threat Detection & Anomaly Response capabilities to baseline normal system behavior and alert on process termination patterns, unauthorized service installations, and credential access anomalies
