Fake LastPass Installer Kills Antivirus With a Microsoft-Signed Driver

On September 17, researchers at LastPass and Delphos Labs described a campaign in which a fake LastPass Authenticator installer drops a Windows kernel driver. The driver shuts off antivirus and EDR tools, and then a password stealer runs. LastPass stresses that none of its systems, services, or customer vaults were touched — the attackers merely borrowed the brand.

The lure and the infection

It starts with a fake GitHub page (github.com/LastPass-Authenticator) that mimics a real product page and ranks for searches like "LastPass Authenticator download." The download button routes visitors through several pages to an attacker server that serves a large ZIP. The genuine app comes only from lastpass.com and the official app stores.

Inside the archive is a renamed copy of Microsoft's legitimate debugging tool vsdbg.exe, sitting next to a malicious vsdbg.dll. When it runs, Windows loads the attacker's library from the same folder — the DLL side-loading trick. The loader tries three routes to administrator rights, reaches SYSTEM, and installs the driver as a service. The archives were 148 MB and 127.9 MB, padded with junk so scanners with size limits skip them.

Why Windows trusts the driver

The driver, which researchers named Alinubx.sys, runs below where antivirus tools operate and terminates every running process it finds against a list of 145 security process names. User-mode tools cannot see or block the kill. The technique is known as BYOVD — bring your own vulnerable driver.

The driver is signed through Microsoft's Windows Hardware Compatibility Publisher chain, dated March 2023, well before this campaign. As the researchers put it, Microsoft attestation proves a driver passed a trust pipeline; it does not prove the driver is safe.

It is in fact a renamed copy of CcProtect.sys from the Chinese disk-encryption product CnCrypt, long listed on LOLDrivers as a process killer. The original tripped 7 of about 70 engines in August; the renamed version tripped zero. Microsoft's vulnerable-driver blocklist matches file hashes, and a new name yields a new hash — neither the original nor the copy was on the list. When Delphos reported it on August 19, Microsoft replied that the behavior does not meet its definition of a vulnerability, since the driver is not a Microsoft component.

What it steals

With security down, the stealer collected passwords from more than two dozen browsers, cryptocurrency wallet files, sessions for Discord, Steam, and Telegram, the contents of Windows Credential Manager, and files named like "password," "seed," or "recovery." For Chrome and Edge with app-bound encryption, it injects into the browser and lets the browser's own service decrypt the data, which is zipped and sent to an attacker server.

The driver stays loaded, re-kills defenses on every reboot, and re-runs the stealer. An affected machine should be treated as a kernel-level compromise, with passwords changed from a separate clean device. The attacker server impersonated at least 40 brands; the loader was built with the Cruciferra crypter, and LastPass calls the stealer Rapuncel.

Source: The Hacker News