Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

[Seceoncompany]

A recent cyberattack shows how threat actors can abuse trusted, Microsoft-signed drivers to bypass endpoint defenses. Researchers identified a campaign where a malicious kernel driver was used to terminate 145 antivirus and endpoint security processes, enabling the Rapuncel infostealer to harvest browser passwords, credentials, tokens, cryptocurrency wallet data, and sensitive files.  For security teams, the incident highlights why digital signatures alone cannot establish trust. Seceon helps organizations strengthen visibility through AI-driven threat detection, behavioral analytics, and cross-environment correlation. By connecting endpoint, identity, network, and security telemetry, Seceon can help teams identify suspicious behavior and respond before credential theft and data exfiltration escalate.