Threat Intel: Alinubx.sys. The Renamed CcProtect Driver Behind a 40-Brand Malware-as-a-Service Campaign

LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team, in partnership with Delphos, identified and disrupted a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub. The payload it delivered was signed through Microsoft's Windows Hardware Compatibility Publisher chain and scored clean on VirusTotal. Signature trust and multi-engine scanning both passed it. LastPass is internally tracking the infostealer as Rapuncel.

The driver that killed 145 security processes in this campaign was already known to defenders under a different name, just the filename changes.

Delphos Labs’s software artifact analysis platform and agentic harness used static analysis, custom decryption, NativeAOT data reconstruction, and emulator-assisted inspection. The full joint report is published on the LastPass blog.

This was opportunistic brand impersonation. No LastPass system, service, or customer vault was involved or compromised. The lure was distributed entirely outside LastPass channels.

This summary reflects the state of the investigation as of September 10, 2026. Threat actor infrastructure changes rapidly.

What is Alinubx.sys?

Alinubx.sys is a Microsoft-attested Windows kernel driver used in this campaign to terminate security software from kernel mode. It is a renamed copy of CcProtect.sys.

The version resources and VirusTotal pivots tie Alinubx.sys to the CnCrypt/CcProtect driver line from Henan Dafeng Software Co., Ltd. CnCrypt is a public Chinese disk encryption and host-defense product, and its protection driver, CcProtect.sys, is catalogued by LOLDrivers as a BYOVD process-killer provider with public proof-of-concept code available. That proof of concept opens \\.\CcProtect, sends IOCTL 0x222024, and passes a PID to kill an arbitrary process. It was dropped to disk as nvfsflt64.sys under the service name NvFsFilter, disguised as an NVIDIA File System Filter Driver.

Our sample kept the CnCrypt product identity and version but changed the driver identity that most defenders would see first. The operators changed the original filename from CcProtect.sys to Alinubx.sys. That single change was enough to slip past detections keyed to the known name. Renaming the file also changes its bytes, which produces a new SHA256, so hash-based detection misses it too.

The functionality stayed recognizable. The identity and the hash both changed enough for detection to miss it.

How did the victim get there?

A user searching for "LastPass Authenticator download" or similar terms encounters a fraudulent GitHub organization page near the top of search results. The page is deliberately SEO-optimized and appears to rank well. Clicking the button takes the victim to a GitHub Pages site that displays a convincing download interface, showing fabricated trust signals along with a spinning animation that says "Validating session / Generating secure token." None of these are real.

Behind the scenes, the page silently routes the victim through two additional observed GitHub Pages accounts that act as hidden waypoints. Each one uses a custom 404.html file containing JavaScript that captures the URL path and silently forwards the victim to the next stage. A separate Cloudflare-fronted server acts as the dynamic traffic director for the chain. Rather than hardcoding the payload server address into the lure pages directly, the chain fetches the destination at runtime, which means the operator can redirect victims to a different payload server at any time without touching any of the GitHub lure infrastructure.

The zip file names and sizes differed slightly but contained identical malware components. The large file size is intentional: most automated security scanning tools have size limits and will skip files this large, allowing the malware to arrive undetected. Two large files included in the archive are pure junk and exist only to inflate it further.

The size-padding angle is familiar. Delphos previously documented a 55MB libpsl-5.dll stealer where most of the file was junk padding used to slip past scanners.

How long did it stay undetected?

It scored 0 out of 72 on VirusTotal as of August 20, 2026, unchanged since July 2025. Delphos reported Alinubx.sys to Microsoft through the MSRC Researcher Portal on August 19, 2026. MSRC responded that the behavior does not meet its definition of a security vulnerability, since the driver is not a Microsoft-owned component, and directed the report to the Windows Defender Security Intelligence driver submission portal. VirusTotal's last analysis for Alinubx.sys showed 3 malicious detections and 71 undetected engines, on September 10, 2026. At publication, Alinubx.sys was not present in the Microsoft vulnerable driver blocklist.

Delphos checked 18 raw driver files from public BYOVD repositories, plus CcProtect.sys and Alinubx.sys, against the Microsoft DriverPolicy_Enforced.xml blocklist downloaded on August 20, 2026. There were 0 of 20 SHA256 matches because the blocklist is a list of known bad hashes. New malware can avoid matching by creating a new hash with techniques such as a filename swap or a recompilation.

Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe.

Why was the signed driver the important payload?

Alinubx.sys exposes an IOCTL interface through \\.\Alinubx. The loader sends IOCTL 0x222024 with target process IDs. The driver resolves each target process with PsLookupProcessByProcessId, opens it with ObOpenObjectByPointer, and terminates it with ZwTerminateProcess. The loader's target set is fixed in code: sub_1800eae00 allocates 0x91 entries, which is 145, and fills them with decrypted EDR/AV process-name strings.

The driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which bypasses the normal user-mode access check at handle-open time. It asks the kernel to open the process as kernel code, then kills it. That is why it can defeat Protected Process Light, the protection many security products rely on to survive an administrator. It does not need to patch EPROCESS protection bits.

This is an abuse-by-design driver rather than a memory-corruption exploit. The process-kill interface appears to be product functionality exposed by a host-defense driver. If the driver is trusted and not blocklisted, administrator rights are enough to install and use it.

A user-mode stealer steals credentials. A trusted kernel driver clears the runway.

What was active, and what was only present in code?

The driver carries more than this deployment used: file and registry hiding, process and driver interception, DLL interception, network control, port redirection, WFP traffic handling, APC-based usermode DLL injection, and a rule configuration system.

We found no evidence that the loader writes the configuration file, sends the configuration IOCTL, activates the network redirect, or performs ProtectR3.dll injection. The driver can also send a JSON rule and version heartbeat over an HTTP POST to a configured URL, but no URL is configured in this sample.

In this deployment, Alinubx acted as an AV killer and its broader functionality remained unconfigured. A future deployment with the configuration file present could activate the rest.

How large is the campaign behind it?

During LastPass' investigation, the TIME team identified albinofennel[.]com was serving at least 40 other branded impersonation lure pages, indicating LastPass was likely just one of the many targets using this same kit. The LastPass lure was a single recent frame in a campaign that has been running for months and shows every sign of continuing after its current infrastructure is burned.

Delphos Labs assesses with high confidence that the loader was produced by the Cruciferra PUROSANGUE crypter package or a close derivative, which was previously documented by Proofpoint in 2025. The strongest overlap is the payload container: this sample stores payloads in .reloc and uses the same custom Base16 style. Our loader contains a decrypted build-environment string naming purosangue and matches the documented PUROSANGUE feature set, including the 145 default AV and EDR process targets.

Delphos also assesses Rapuncel is a BoryptGrab-related variant or sibling build, not a confirmed match to any of Trend Micro's published samples. The payloads are not byte-identical, but both produce the same collection artifacts, including a misspelled Filegraber directory, and both embed a browser helper that calls the browser Elevation Service to bypass Chrome app-bound encryption. Delphos assesses this as a highly specific workflow, not generic stealer boilerplate.

Delphos Labs analyzed the compiled artifact directly, which allowed the inspection of the binary rather than relying on weaker antivirus signatures.

What should someone who ran the installer do?

Treat every credential stored in the browser on that machine as exposed, along with cryptocurrency wallet files, Discord and Steam and Telegram session data, and anything held in Windows Credential Manager. The stealer collected and exfiltrated these before the driver work began. Change those credentials from a separate, known-clean device rather than the affected one.

Any machine that executed this payload should consider kernel-level forensic investigation, because Alinubx.sys defeats the user-mode tooling that would normally perform the cleanup.

What should defenders hunt for?

Microsoft-attested drivers whose Authenticode programName contains the Henan Dafeng identity or whose version resources contain CnCrypt.

Drivers with OriginalFilename or strings matching CcProtect.sys, Alinubx.sys, Alinubx, ProtectR3.dll, or \\.\Alinubx.

Service creation for NvFsFilter or file writes to C:\Windows\System32\drivers\nvfsflt64.sys.

Driver load followed by termination of security processes through kernel activity.

PE files where the raw .reloc section is much larger than the size declared in IMAGE_DIRECTORY_ENTRY_BASERELOC.

What does this mean for defenders?

Hashes and payload server addresses can easily be rotated. In this campaign, one payload server dropped off DNS during the analysis window while two others stayed live. As signatures and IP addresses are discovered, operators will redeploy to fresh infrastructure, recompile with a new signature, and swap the driver filename again, the same way CcProtect.sys became Alinubx.sys.

This campaign chained together four separate trust assumptions and broke each one: that a recognizable brand on GitHub means an official channel, that a Microsoft signature means a vetted driver, that a clean VirusTotal score means a safe file, and that a blocklist covers the drivers that matter.

Delphos analyzes compiled code to reveal intent, without source and without prior knowledge of the sample. That is the analytical posture this class of threat requires.

Confirmed Hashes

Component	SHA256
vsdbg.dll (.NET NativeAOT loader)	ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6
Rapuncel stealer	aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd
Alinubx.sys (kernel driver)	611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61
Browser injection DLL	75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40
ProtectR3.dll x64 (unpacked)	26db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8
CcProtect.sys v1.32 (reference, LOLDrivers)	5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c

Full domain and IP indicators, the MITRE ATT&CK mapping, the complete Cruciferra and BoryptGrab comparison, and the disclosure timeline are in the full joint report from the LastPass TIME team and Delphos Labs.

Related reading: A sideloading DLL padded to 55MB