GitHub SEO Poisoning Campaign Delivers Rapuncel Stealer via Microsoft-Attested Kernel Driver Killing 145 EDR Tools

The campaign, active for months and discovered August 13, routed victims through chained GitHub repositories and Cloudflare servers to a renamed Microsoft debugger executable that loaded a malicious DLL. Execution granted system privileges, installed the NVIDIA-masquerading driver, and launched Rapuncel as a persistent service that repeatedly scans for and kills restarted EDR processes while harvesting browser credentials, 30 crypto wallets, Discord/Steam/Telegram tokens, and screenshots. Evidence from LastPass and Delphos shows the DLL matches the PUROSANGUE package from Cruciferra crypter, documented by Proofpoint in July, with behavioral overlaps to Trend Micro’s BoryptGrab samples distributed across 100 GitHub repos earlier this year. The driver’s self-hiding and process-injection code was present but unconfigured in observed samples, indicating iterative development. This pattern reveals systematic abuse of GitHub discoverability and Microsoft driver attestation for kernel-level EDR bypass, extending beyond opportunistic brand spoofing of 40 organizations. The dynamic redirect chain and ongoing server maintenance through September 10 demonstrate operator investment in resilient distribution rather than one-off lures. Next indicators include new GitHub repos testing updated driver configurations and expanded target lists; monitoring for PUROSANGUE-linked DLLs in VirusTotal submissions over the next 60 days will confirm variant spread.