GoKawiilAn ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel.
LastPass and Delphos Labs uncovered the campaign, which they report impersonates the password manager brand and at least 39 other companies.
Alongside the Rapuncel infostealer, the repositories deliver a Microsoft-signed kernel driver that can disable 145 antivirus and endpoint detection and response (EDR) products.
The attack chain begins when victims search for LastPass Authenticator or other popular software and follow links to fake GitHub repos.
There, clicking download buttons triggers a series of redirections before reaching payload-delivery servers, where victims receive ZIP archives with their size inflated to up to 148MB to evade security scans.
The installer inside the archives is a copy of the legitimate Microsoft Visual Studio CoreCLR Debugger, 'vsdbg.exe,' renamed and configured to sideload a malicious DLL (vsdbg.dll). The installer deploys the Rapuncel infostealer as well as the Alinubx.sys kernel driver, which is used to kill antivirus software.
Malicious GitHub page
Source: LastPass
The kernel driver is disguised as an NVIDIA component named 'nvfsflt64.sys' and registers as the NvFsFilter service.
According to the researchers, the driver acts as an EDR killer that contains a hardcoded list of 145 antivirus and EDR processes that it aims to terminate.
... continue reading