Rapuncel

Family profile

Rapuncel is a Windows information stealer distributed in a search-engine-optimization poisoning campaign that impersonates software vendors, including LastPass, through fraudulent GitHub repositories and download pages. Victims receive inflated ZIP archives containing a disguised installer that uses DLL side-loading to execute the payload. The campaign deploys a Microsoft-attested kernel driver derived from the CnCrypt/CcProtect driver line to terminate antivirus and EDR processes, including protected processes, before running the stealer. Rapuncel obtains elevated privileges, establishes auto-start Windows service persistence, and repeatedly suppresses restarted security tools. It steals saved browser credentials, cryptocurrency-wallet data, Discord tokens, Steam and Telegram session data, Windows Credential Manager contents, selected credential- and wallet-related documents, screenshots, and host information. It bypasses Chrome and Edge app-bound encryption through browser-process injection and use of browser decryption services, then compresses and exfiltrates collected data. The loader has been assessed as likely built with, or closely derived from, Cruciferra PUROSANGUE. Rapuncel has moderate-confidence behavioral and delivery-chain links to the BoryptGrab ecosystem, but is not assessed as an identical build.

Capabilities

Byovd
Credential Theft
Crypto Theft
Defense Evasion
Dll Sideloading
Exfiltration
Persistence
Privilege Escalation
Process Injection
Reconnaissance
Session Hijacking

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Sep 21

Observed infrastructure

Last seven days

First activity: Sep 22, 2026
Last activity: Sep 22, 2026
Feed role: C2
Host form: 0 IP / 1 hostnames

Leading locations

Leading providers

Cloudflare, Inc.1

Infrastructure traits

Anycast 1
Hosting 1

MITRE ATT&CK

Rapuncel in ATT&CK

32 distinct techniques

Techniques

32 techniques

T1562.001 Disable or Modify Tools T1557 Adversary-in-the-Middle T1113 Screen Capture T1583.001 Domains T1005 Data from Local System T1608.004 Drive-by Target T1055.012 Process Hollowing T1041 Exfiltration Over C2 Channel T1555.003 Credentials from Web Browsers T1543.003 Windows Service T1055.004 Asynchronous Procedure Call T1539 Steal Web Session Cookie T1082 System Information Discovery T1555.004 Windows Credential Manager T1560 Archive Collected Data T1608.006 SEO Poisoning T1036 Masquerading T1204.002 Malicious File T1027.001 Binary Padding T1055 Process Injection T1560.001 Archive via Utility T1014 Rootkit T1548 Abuse Elevation Control Mechanism T1036.005 Match Legitimate Resource Name or Location T1489 Service Stop T1566.002 Spearphishing Link T1027 Obfuscated Files or Information T1071.001 Web Protocols T1548.002 Bypass User Account Control T1555 Credentials from Password Stores T1553.002 Code Signing T1593 Search Open Websites/Domains