Security researchers have uncovered an active malware distribution campaign using trojanized installers impersonating LastPass and at least 40 other legitimate software brands. The payload chain is notable for its aggression: before deploying the 'Rapuncel' infostealer, the malware loads a kernel-level driver specifically designed to terminate and disable 145 different security products — effectively blinding the endpoint before theft begins.
This is not a spray-and-pray consumer campaign. Bring-your-own-vulnerable-driver (BYOVD) EDR killers are a technique historically associated with ransomware operators and advanced intrusion sets. Their presence in an infostealer dropper signals that commodity credential theft operations have matured to the point where defeating enterprise-grade endpoint controls is a standard part of the kill chain. If your users can install software — or think they can — you are in scope for this campaign.
Technical Analysis
Delivery and Impersonation
The campaign distributes fake installers posing as legitimate applications, with LastPass password manager installers among the most prominent lures. Password managers are a high-value impersonation target for an obvious reason: a user installing a password manager is about to centralize their most sensitive credentials, and the act of installing security software carries inherent trust. The attackers impersonate at least 40 companies, indicating a broad malvertising/SEO-poisoning or lookalike-domain distribution operation rather than a targeted spear-phishing effort.
Typical delivery vectors for campaigns of this type include:
- Malicious ads and poisoned search results for queries like "LastPass download" or "password manager installer"
- Lookalike domains serving signed-appearing installer bundles (MSI/EXE)
- Cracked software and "free premium" download portals
The Kernel-Level EDR Killer (BYOVD)
The differentiator in this campaign is the kernel-mode component. The malware installs a driver — almost certainly a legitimate-but-vulnerable signed driver abused via BYOVD — to gain kernel privileges, then uses those privileges to terminate, suspend, or otherwise neutralize endpoint security processes. The kill list reportedly covers 145 security products, spanning major EDR, antivirus, and monitoring vendors.
From a defender's perspective, the attack chain looks like this:
- User downloads and executes a fake installer (e.g.,
LastPassSetup.exeor similar) from a malicious site. - The dropper writes a driver file (
.sys) to disk, commonly under%TEMP%,%APPDATA%, or%ProgramData%, and creates a kernel service viasc.exe createor direct registry manipulation (HKLM\SYSTEM\CurrentControlSet\Services\). - The driver loads and issues kernel-mode terminations against security product processes, or removes their callbacks — actions a user-mode process cannot perform against a protected (PPL) security process.
- With telemetry blinded, the Rapuncel stealer executes, harvesting browser credentials, cookies, session tokens, cryptocurrency wallets, and password manager data, then exfiltrates to attacker-controlled infrastructure.
The critical defensive insight: the moment the driver loads, your EDR may stop reporting without any error. Self-defense tamper events, unexpected driver loads, and EDR service state changes are your last reliable signals.
Exploitation Status
This campaign is confirmed active in the wild. It requires no vulnerability in LastPass itself — the attack abuses user trust and driver-signing trust models. No CVE is associated with this reporting; the BYOVD technique typically leverages one of several known-vulnerable signed drivers that remain loadable on systems without an up-to-date Microsoft vulnerable driver blocklist.
Detection & Response
Hunt for the kill chain, not just the stealer. The highest-fidelity signals are: (1) unsigned or rarely-seen kernel drivers loaded by non-system processes, (2) tampering with security product services, and (3) user-profile execution of password-manager-branded installers from non-standard paths.
Sigma Rules
---
title: Fake Password Manager Installer Executed From User Profile
id: 2f7a1c94-8b3e-4d21-9f05-6a1b2c3d4e5f
status: experimental
description: Detects execution of installers branded as LastPass or other password managers from user-writable or temporary paths, consistent with trojanized installer delivery observed in the Rapuncel stealer campaign.
references:
- https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection_brand:
Image|contains:
- 'lastpass'
- '1password'
- 'bitwarden'
- 'dashlane'
- 'keepass'
selection_path:
Image|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Downloads\'
- '\ProgramData\'
- '\Users\Public\'
condition: all of selection_*
falsepositives:
- Users legitimately running downloaded installers from Downloads
level: medium
---
title: Kernel Driver Installed From User-Writable Path (BYOVD EDR Killer)
id: 9c4e2b17-3d5f-4a68-b812-7e9f0a1b2c3d
status: experimental
description: Detects creation of a kernel service whose driver binary resides in a user-writable directory, a hallmark of BYOVD EDR-killer deployment used to disable security products before infostealer execution.
references:
- https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/
- https://attack.mitre.org/techniques/T1068/
- https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.privilege_escalation
- attack.t1068
- attack.defense_evasion
- attack.t1562.001
logsource:
category: registry_set
product: windows
detection:
selection_key:
TargetObject|contains: '\CurrentControlSet\Services\'
TargetObject|endswith: '\ImagePath'
selection_path:
Details|contains:
- '\AppData\'
- '\Temp\'
- '\ProgramData\'
- '\Users\Public\'
- '\Windows\Temp\'
selection_ext:
Details|endswith: '.sys'
condition: selection_key and selection_path and selection_ext
falsepositives:
- Rare; legitimate kernel drivers are virtually never installed from user-writable paths
level: critical
---
title: Security Product Service Stopped or Disabled via Command Line
id: 5b8d3e60-1f47-4c29-a956-8d2e3f4a5b6c
status: experimental
description: Detects attempts to stop, disable, or delete security product services using sc.exe or net.exe, consistent with EDR-killer behavior in the Rapuncel campaign which targets 145 security products.
references:
- https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/
- https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/02/14
tags:
- attack.defense_evasion
- attack.t1562.001
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '\sc.exe'
- '\net.exe'
- '\net1.exe'
selection_action:
CommandLine|contains:
- ' stop '
- ' delete '
- 'config'
- ' disable'
selection_target:
CommandLine|contains:
- 'defender'
- 'sentinel'
- 'crowdstrike'
- 'csagent'
- 'falcon'
- 'carbonblack'
- 'cb'
- 'sophos'
- 'trend'
- 'cylance'
- 'elastic'
- 'sysmon'
- 'windefend'
- 'msmpeng'
condition: selection_tool and selection_action and selection_target
falsepositives:
- Legitimate administrator maintenance of security agents (rare, typically via vendor console)
level: high
KQL (Microsoft Sentinel / Defender)
The following hunt combines driver loads from suspicious paths with security-service tampering in a correlated window — the EDR-killer sequence in one query:
let SuspiciousPaths = dynamic(["\\appdata\\", "\\programdata\\", "\\users\\public\\", "\\windows\\temp\\"]);
let TamperWindow = 30m;
let DriverEvents = DeviceEvents
| where ActionType == "DriverLoad" or (ActionType == "ServiceInstalled" and AdditionalInformation has "kernel")
| extend LowerPath = tolower(AdditionalInformation)
| where LowerPath has_any (SuspiciousPaths) and LowerPath endswith ".sys"
| project DriverTime = TimeGenerated, DeviceId, DeviceName, DriverInfo = AdditionalInformation, InitiatingProcessFileName;
let TamperEvents = DeviceProcessEvents
| where FileName in~ ("sc.exe", "net.exe", "net1.exe", "taskkill.exe", "powershell.exe")
| where ProcessCommandLine has_any ("stop", "delete", "disable")
| where ProcessCommandLine has_any ("defender", "sentinel", "crowdstrike", "csagent", "sophos", "cylance", "carbonblack", "sysmon", "windefend", "msmpeng", "elastic")
| project TamperTime = TimeGenerated, DeviceId, TamperCommand = ProcessCommandLine, TamperProcess = FileName;
TamperEvents
| join kind=inner DriverEvents on DeviceId
| where TamperTime between (DriverTime .. (DriverTime + TamperWindow))
| project DriverTime, TamperTime, DeviceName, InitiatingProcessFileName, DriverInfo, TamperProcess, TamperCommand
| sort by DriverTime desc;
A secondary hunt for the fake-installer stage across your fleet:
DeviceProcessEvents
| where FileName has_any ("lastpass", "1password", "bitwarden", "dashlane")
or ProcessCommandLine has_any ("lastpass", "1password", "bitwarden", "dashlane")
| where FolderPath has_any ("\\downloads\\", "\\appdata\\local\\temp\\", "\\programdata\\", "\\users\\public\\")
| extend SignatureInfo = tostring(parse_json(AdditionalInformation).Signer)
| where isempty(SignatureInfo) or SignatureInfo !has "LastPass" and FileName has "lastpass"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, SignatureInfo
| sort by TimeGenerated desc;
Tune the signer validation to your actual LastPass deployment source — managed deployments via Intune/SCCM should be allowlisted by path.
Velociraptor VQL
Hunt for recently created kernel services pointing at driver binaries in non-standard locations:
-- Hunt for kernel services with drivers in user-writable paths (BYOVD EDR killer)
SELECT Name,
DisplayName,
ImagePath,
ServiceDll,
StartName,
Mtime AS RegistryKeyModified
FROM read_reg_key(globs='HKLM/SYSTEM/CurrentControlSet/Services/*/ImagePath',
accessor='registry')
WHERE ImagePath =~ '(?i)\\\\(appdata|programdata|temp|users\\\\public)'
AND ImagePath =~ '(?i)\\.sys'
ORDER BY RegistryKeyModified DESC
And to enumerate loaded drivers not backed by the standard system directories:
-- Enumerate processes and flag any masquerading as password manager installers
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)(lastpass|1password|bitwarden|dashlane)'
OR Exe =~ '(?i)(lastpass|1password|bitwarden|dashlane)')
AND Exe =~ '(?i)(appdata|temp|downloads|programdata|users\\\\public)'
Remediation and Hardening
There is no patch for this campaign — it is social engineering plus BYOVD, and defense is layered. Prioritize the following:
1. Enable and enforce the Microsoft Vulnerable Driver Blocklist. This is the single highest-value control against BYOVD EDR killers. The blocklist ships with Windows and is updated by Microsoft; it must be actively enforced:
# Verify and enforce Microsoft Vulnerable Driver Blocklist (requires Windows 11 2022+ or W10 with updates)
# Run as Administrator. Reboot required after changes.
# 1. Check current blocklist enforcement state
$blocklist = Get-CimInstance -Namespace 'root\Microsoft\Windows\CI' -ClassName 'PS_MicrosoftWindowsDriverBlockList' -ErrorAction SilentlyContinue
if ($blocklist) { $blocklist | Format-List } else { Write-Host 'Blocklist class not available - verify OS build and update level.' -ForegroundColor Yellow }
# 2. Enable VBS / HVCI prerequisite check (blocklist enforcement requires VBS)
$vbs = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace 'root\Microsoft\Windows\DeviceGuard' -ErrorAction SilentlyContinue
$vbs | Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning
# 3. Enforce blocklist via registry (1 = enforced)
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Config' -Name 'VulnerableDriverBlocklistEnable' -Value 1 -Type DWord
# 4. Enable Smart App Control / SmartScreen reputation checks for downloaded installers
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -SubmitSamplesConsent SendAllSamples
# 5. Audit: list kernel services whose binaries live outside System32\drivers
Get-CimInstance Win32_SystemDriver |
Where-Object { $_.PathName -and $_.PathName -notmatch '(?i)system32\\drivers|system32\\DriverStore' } |
Select-Object Name, DisplayName, State, StartMode, PathName |
Format-Table -AutoSize
Write-Host 'Reboot required for blocklist changes to take effect.' -ForegroundColor Cyan
2. Constrain software installation. Users should not be running password manager installers from browser downloads. Deploy LastPass (and all security tooling) via your MDM/SCCM/Intune pipeline from vendor-verified sources, and enforce application control (WDAC or AppLocker) blocking unsigned executables in user-writable paths. An unsigned LastPassSetup.exe in %TEMP% should be a hard block, not a detection.
3. Harden EDR tamper protection. Verify tamper protection is enabled on every endpoint security agent and that your EDR consoles alert on agent heartbeat loss, unexpected service stops, and sensor isolation. Treat any EDR agent that goes silent on a live host as a P1 incident — silence is the symptom of this attack.
4. Control the delivery vector. Block newly registered and lookalike domains at the DNS/proxy layer, deploy browser isolation or SmartScreen/URL filtering for software-download categories, and run targeted user awareness on malvertising and SEO poisoning for "download" queries. Users should navigate to the vendor domain directly, never through ads or search results.
5. Incident response posture. If you detect the driver-install or service-tamper stage on a host: isolate it from the network immediately (before the stealer stage may complete exfiltration if the kill chain is in progress), acquire memory and triage artifacts with Velociraptor or your EDR, and assume credential compromise if Rapuncel executed — force resets of any credentials stored in browsers or accessible vaults on that host, invalidate session tokens, and review MFA fatigue risk on affected accounts.
6. Monitor for the kill list. The campaign's 145-product target list means no EDR vendor is exempt. Build detections on service-state changes for every security agent in your stack, not just the primary EDR — Sysmon, forwarders, and sensor services are all targets.
The broader lesson: infostealer operations now routinely ship the same defense-evasion tooling we used to attribute to ransomware crews. If your detections assume commodity stealers are 'low sophistication,' this campaign is your corrective.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.