Book An Appointment

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords
Modern endpoint attacks are increasingly targeting the security controls themselves. Instead of simply attempting to evade antivirus or EDR detection, attackers are finding ways to disable those defenses at the Windows kernel level and then operate with significantly reduced visibility. According to Cybersecurity News, researchers have uncovered a malware campaign in which attackers used a Microsoft-attested Windows kernel driver to disable 145 antivirus and endpoint security processes before deploying an information-stealing malware known as Rapuncel. The campaign ultimately targeted browser passwords, cryptocurrency wallets, session data, messaging information, Windows credentials, screenshots, and sensitive documents. The operation was identified by the LastPass Threat Intelligence, Mitigation, and Escalation team in collaboration with Delphos Labs. Importantly, the campaign did not compromise LastPass systems, services, or customer vaults. Instead, attackers abused the LastPass brand to make fraudulent download pages appear legitimate.

The Attack Starts With a Fake LastPass Authenticator

The campaign begins with social engineering rather than a sophisticated exploit. Victims searching online for “LastPass Authenticator download” could encounter a fraudulent GitHub organization designed to resemble an official LastPass product page. The fake page used LastPass branding, SEO-oriented descriptions, and a download button to create the appearance of legitimacy. When a victim clicked the download button, the request passed through multiple GitHub Pages sites before reaching attacker-controlled infrastructure. The operators also used hidden redirect GitHub Pages and a Cloudflare-protected traffic layer. This allowed them to change the infrastructure hosting the payload without having to modify the publicly visible lure pages. The final payload was delivered as a very large ZIP archive, sometimes exceeding 100 MB. Researchers reported that the archives contained junk files designed to exceed automated sandbox and scanning limits. This is an important defensive detail. The attack was not relying on a single malicious executable being immediately recognized. Instead, the delivery chain combined brand impersonation, trusted infrastructure, redirects, oversized archives, and execution techniques intended to make automated analysis more difficult.

A Trusted Microsoft Component Becomes the Launch Point

Inside the archive, attackers placed a renamed Microsoft debugging executable, vsdbg.exe, alongside a malicious vsdbg.dll. Windows loaded the malicious DLL through DLL side-loading, allowing the attacker’s loader to execute while appearing to operate alongside a legitimate Microsoft component. After obtaining elevated privileges, the malware deployed a kernel driver originally named Alinubx.sys but stored on the compromised system as: C:\Windows\System32\drivers\nvfsflt64.sys The driver was registered as the “NVIDIA File System Filter Driver.” The critical issue was its trust relationship with Windows. The driver carried a Microsoft Windows Hardware Compatibility Publisher signature chain, helping it appear legitimate to the operating system and security controls. Yet the driver contained functionality capable of terminating security software directly from kernel mode. This creates a particularly dangerous defensive situation: a security platform may recognize that a component is digitally signed while still failing to understand that its behavior is hostile.

145 Security Products Targeted at Kernel Level

The malicious driver contained 145 hardcoded process names associated with antivirus and endpoint detection and response products. It used a kernel-level process termination mechanism to stop those security processes, including products protected by Windows Protected Process Light (PPL). Researchers linked the driver to the CnCrypt or CcProtect driver line associated with Henan Dafeng Software. The attackers appear to have renamed the driver while retaining its process-killing capability. At the time researchers checked, the driver was not present in Microsoft’s vulnerable driver blocklist. Its clean or near-clean detection history also contributed to its ability to evade conventional signature-based defenses. This is where the campaign demonstrates a fundamental weakness in file-centric security models. A valid signature does not automatically mean that every action performed by the signed component is trustworthy. The more meaningful question becomes: What is this driver doing on this endpoint, what process installed it, what processes is it terminating, and what happens immediately afterward?

Once Defenses Are Disabled, Rapuncel Steals the Credentials

After neutralizing endpoint security controls, the attackers deployed Rapuncel, an information-stealing malware designed to harvest a broad range of sensitive information. The malware collected saved browser passwords from more than 25 browsers. It also targeted the app-bound encryption mechanisms used by Chrome and Edge. Rapuncel used browser-process injection to request password decryption from within the browser process itself. The credential theft did not stop at browser passwords. Rapuncel also targeted:
  • Cryptocurrency wallet files
  • Discord tokens
  • Steam session information
  • Telegram information
  • Windows Credential Manager data
  • Screenshots
  • Documents containing terms such as password, seed, wallet, and recovery
The stolen information was compressed into a ZIP archive and transmitted to the reported command-and-control endpoint at: 2.26.126[.]50 The sequence is therefore particularly significant: Fake download page → GitHub-based redirects → oversized ZIP archive → DLL side-loading → elevated privileges → Microsoft-signed kernel driver → security-tool termination → Rapuncel deployment → credential and sensitive-data theft → compressed exfiltration The security-control bypass is not the end of the attack. It is what enables the credential theft stage to operate with substantially less resistance.

Why Signed Drivers Are Becoming a Major Security Blind Spot

The campaign highlights the growing importance of Bring Your Own Vulnerable Driver (BYOVD) and trusted-driver abuse techniques. Traditional endpoint detection often places significant weight on whether a file is known to be malicious. But attackers can exploit trusted components, signed drivers, legitimate utilities, and commonly used infrastructure to create activity that looks legitimate at the individual-event level. A signed driver terminating dozens of security processes, however, represents a completely different behavioral signal. The important indicators are not necessarily limited to the driver’s reputation or signature. They include:
  • A new kernel driver appearing unexpectedly
  • Creation of a suspicious driver service
  • A renamed Microsoft executable launching an unusual child process
  • DLL side-loading involving vsdbg.exe and vsdbg.dll
  • Kernel-level termination of multiple security processes
  • Security controls becoming inactive immediately before credential-access activity
  • Browser-process injection followed by credential collection
  • Large ZIP archives created after credential harvesting
  • Outbound communication to suspicious infrastructure
This is precisely where behavioral correlation becomes more important than isolated file reputation.

Seceon: Detecting the Attack Beyond the Signed File

aiXDR-PMax: Detect the Endpoint Behavior

The most important Seceon capability for this attack chain is aiXDR-PMax. A signed driver should not automatically be treated as safe simply because its certificate appears legitimate. Endpoint telemetry needs to establish whether its behavior fits the normal operating profile of the system. aiXDR-PMax can help provide visibility across the endpoint attack sequence, including suspicious executable behavior, DLL side-loading, privilege-related activity, process execution, driver activity, credential-access behavior, and other endpoint indicators. For an attack such as Rapuncel, the key is connecting events that individually might appear unrelated: vsdbg.exe → vsdbg.dll side-loading → driver installation → security-process termination → browser credential access → data collection That behavioral chain is much more meaningful than evaluating each file independently.

aiSIEM / CGuard: Correlate the Attack Across the Environment

Endpoint activity becomes significantly more useful when correlated with network, identity, log, and infrastructure telemetry. aiSIEM / CGuard can bring these signals together to help security teams identify relationships between:
  • Suspicious GitHub-based download activity
  • Large archive downloads
  • Endpoint execution
  • Driver installation
  • Security-tool termination
  • Credential-access events
  • Unusual outbound communication
  • Data compression and exfiltration indicators
This correlation helps SOC teams move from individual alerts toward an incident-level understanding of what is happening. For example, a signed driver by itself may not immediately indicate compromise. But a newly installed driver followed by mass termination of security processes and subsequent credential collection represents a much stronger behavioral signal.

aiBAS360: Validate Whether Defenses Can Withstand Driver-Based Evasion

aiBAS360 can complement detection by helping organizations validate whether their security controls can identify and respond to attack techniques involving defense evasion, privileged execution, credential access, and endpoint compromise. The objective is not simply to confirm that an endpoint product is installed. Organizations need to determine whether their security architecture can still detect meaningful activity when an attacker attempts to interfere with the endpoint’s security controls.

The Detection Strategy Must Survive the Loss of an Endpoint Control

One of the most important lessons from this campaign is that an endpoint security product cannot be treated as the only source of truth. If an attacker succeeds in terminating security processes, the organization still needs visibility from other layers. That means detection should extend across: Endpoint + identity + network + process behavior + driver activity + data movement This layered approach becomes particularly important when attackers operate at kernel level. The Rapuncel campaign demonstrates why behavioral detection and cross-domain correlation are critical. The attackers did not simply deploy an infostealer. They first created the conditions necessary for the infostealer to operate with reduced security visibility. The driver was therefore a strategic component of the attack chain, not merely another malware file.

Key Indicators for Security Teams

Cybersecurity News and the associated threat intelligence reporting identified several artifacts that organizations can investigate.
Indicator Type Indicator
Malicious driver SHA-256 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61
Rapuncel payload SHA-256 aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd
Primary payload server albinofennel[.]com
Secondary payload server hanselarinmusky[.]com
Fake GitHub repository github[.]com/LastPass-Authenticator
Fake GitHub Pages portal lastpass-authenticator[.]github[.]io
Exfiltration IP 2.26.126[.]50
Malicious driver path C:\Windows\System32\drivers\nvfsflt64.sys
Driver service NvFsFilter
Driver interface \\.\Alinubx
Rootkit helper ProtectR3.dll
Malicious loader vsdbg.dll
Credential-stealing artifact browser_decryption.log
Related signing identity Henan Dafeng Software Co., Ltd.
Organizations should also investigate the creation of the NvFsFilter service, writes to the nvfsflt64.sys driver path, renamed vsdbg.exe processes spawning unusual child processes, and kernel driver activity followed by mass termination of security tools.

From Trusted Components to Trusted Behavior

The Rapuncel campaign illustrates an important evolution in endpoint attacks. Attackers do not necessarily need to make their malware look completely legitimate. They can instead combine legitimate-looking infrastructure, signed components, trusted applications, and kernel-level capabilities to make individual stages difficult to classify. That changes the defensive question from: “Is this file malicious?” to: “Is this behavior consistent with what this system should be doing?” A Microsoft-attested driver terminating 145 security processes is a powerful example of why that distinction matters. Once security controls are disabled, credential theft becomes significantly easier. Browser passwords, tokens, wallet files, messaging data, and Windows credentials can then become available to the attacker, turning one compromised endpoint into a potential source of broader identity and financial exposure. Organizations therefore need security architectures that can recognize the entire behavioral sequence, correlate activity across multiple telemetry sources, and continue providing detection when an attacker attempts to blind the endpoint itself. The Rapuncel campaign is a clear reminder that trust should be continuously validated through behavior, not granted permanently because a component carries a legitimate signature. Footer-for-Blogs-3

Categories

Copyright @Seceon Inc 2026. All Rights Reserved.

Seceon Inc