Rapuncel: the GitHub download was a signed driver, and the signature was not the last word

Saturday's patch list is still a federal clock. ISE, the Acronis hosting-panel plugin, and the Pixel modem are due today. The Linux kernel trio we wrote this morning is due Sunday. Those are appliances and servers. The story that showed up on the same calendar and will not make a KEV row is a Google result that looks like GitHub.

LastPass and Delphos Labs described a campaign that uses search-ranked fake GitHub repos to impersonate LastPass Authenticator and at least 39 other brands. BleepingComputer carried it on September 18. The ZIP is padded, sometimes toward 148 MB, so a scanner that gives up on fat archives looks the other way. Inside is a renamed copy of Microsoft's own Visual Studio debugger, vsdbg.exe, set up to load a DLL that does not belong to it. That loader drops two things: an infostealer they call Rapuncel, and a kernel driver named Alinubx.sys. The driver is written to disk as nvfsflt64.sys and registered as a service called NvFsFilter, which is an NVIDIA-shaped lie. It is signed through Microsoft's Windows Hardware Compatibility Publisher chain. At the time of the write-up it was not on the vulnerable-driver blocklist. A signature is a pipeline stamp. It is not a character reference.

What the signed driver is for

The driver carries a list of 145 antivirus and EDR process names. From kernel mode it opens those processes and terminates them. Protected Process Light, the thing most endpoint tools lean on so a local admin cannot just kill them, does not apply once the request is coming from the kernel. After the field is cleared, Rapuncel takes browser stores (they name 25), wallet data (they name 30), Discord and Steam and Telegram sessions, Windows Credential Manager, screenshots, and documents whose names look like recovery material. It stays as a Windows service so the next reboot kills the tools again before the stealer runs.

LastPass says the driver has more room in it (hiding files, injecting, playing with traffic) that this campaign does not turn on. Treat that as unused capacity, not comfort. They rate Rapuncel, with moderate confidence, as a relative of BoryptGrab. The loader used a crypter sold as Cruciferra PUROSANGUE. We are not going to walk the sideload. The operational fact is enough: a promoted GitHub download can put a signed kernel driver on a laptop that already holds the password vault you were trying to install.

Why a shop in Alberta should care

This is not a nation-state puzzle. It is a person who typed "LastPass Authenticator download" or the name of some other tool, trusted the GitHub URL at the top of Google, and clicked the big button. Developer laptops, office PCs, and the one machine that still has the password export on the desktop are the same target. If your EDR vanished for twenty minutes and came back, that is not a flaky agent. That is a ticket.

Yesterday we wrote about Plugin4Shell: an AI coding agent that thought a pin was a pin. Today is the same neighborhood with a dumber lure. Do not let the two stories blur. One is a resolver you already installed. The other is a search result you should not have trusted. Both assume GitHub is a safe neighborhood because the URL says so.

The rest of Saturday, in one paragraph

CISA's weekend list is ISE (CVE-2026-76460), Acronis backup on cPanel and Plesk (CVE-2026-87886), and Pixel 2026-09-05 (CVE-2026-58704). We covered those earlier in the week. This morning we added the kernel KEV trio due Sunday, the IDScan.net licence-scan breach the RCMP is monitoring, and Check Point's management-server overflow (CVE-2026-91843) that still has no known use. On the site-security side, CISA's midweek ICS note on Digital Watchdog VMAX DVR and NVR boxes (ICSA-26-258-01) is the recorder version of the same lesson: hard-coded FTP, missing auth on the web UI, a box that can become a pivot. Firmware is on the vendor download page. Adjacent-network, not internet-wide, and no reported use yet. If that NVR is on the office VLAN anyway, the distinction is academic.

What we would check before Monday

• Software installs this month that arrived from a GitHub URL found in a search ad or a promoted result. Official vendor site only. If the repo org is a week old and the README is a sales page, that is not upstream.
• Look for vsdbg.exe loading a DLL that Microsoft did not ship, a driver named nvfsflt64.sys, and a service named NvFsFilter. Those are the breadcrumbs LastPass published. A hit is containment, not a curiosity.
• If EDR died and revived, treat the host as unclean. Credential reset for anything that machine could reach, including the vault you were trying to install.
• Blocklist policy is not "we trust WHCP signatures." Ask whether your endpoint stack will load an unknown NVIDIA-shaped filter driver on a machine that has no NVIDIA storage stack.
• Today's named clock still stands: ISE, Acronis plugin build, Pixel patch date. Sunday is the kernel reboot. If you have a Digital Watchdog VMAX or VG4 recorder, pull firmware from digital-watchdog.com/downloads and take FTP off the LAN.

Bottom line

A signed driver in a fake GitHub ZIP is a supply-chain problem that looks like a download button. Forensic Five reviews what people actually installed, including the tool that arrived because Google put it first. From St. Albert, Alberta. Stop trusting the search result. Then go finish Cisco.