Rapuncel Infostealer Uses Microsoft-Signed Driver to Disable Antivirus Software
A Windows infostealer named Rapuncel has been stealing browser and wallet credentials from infected machines by disabling antivirus software. It achieves this by terminating every major antivirus or endpoint detection tool running on the computer using a Microsoft-signed kernel driver.
The campaign, disclosed jointly by LastPass and Delphos Labs, impersonated at least 40 software brands through fraudulent GitHub repositories since August 13, 2026. The attackers changed the filename of an already publicly documented driver to evade detection.
The kernel driver, Alinubx.sys, opens 145 hardcoded antivirus and endpoint detection processes from kernel mode and terminates them one by one, bypassing Windows' protection mechanism. It is signed through Microsoft's Windows Hardware Compatibility Publisher chain but does not prove the driver is safe.
Researchers had already documented the underlying driver it was derived from, CcProtect.sys, a process-protection driver distributed by Henan Dafeng Software Co., Ltd. The attackers resubmitted it through the program with a new filename, producing a new hash that evaded detection.