Ethical Hacking News
A recent malware campaign has exposed a fake LastPass Authenticator installer that installs a Windows kernel driver, effectively shutting down antivirus and endpoint detection and response (EDR) tools before a password stealer runs its course. The malicious driver, masquerading as a legitimate LastPass Authenticator download, was found on a GitHub page that ranks high in search results for the terms "LastPass Authenticator download." The attack vector used here is an example of a malicious driver exploiting the trust of the system by loading a driver signed through the Microsoft Windows Hardware Compatibility Publisher chain, a process that has been scrutinized for its vulnerability.
Malware campaigns are using fake Microsoft-signed drivers to install malware on systems, shutting down antivirus and EDR tools.A fake LastPass Authenticator installer was found on a GitHub page, leading to a malicious payload that steals passwords, cryptocurrency, and login sessions.The malicious driver, signed through Microsoft's Hardware Compatibility Publisher chain, terminates antivirus software and re-runs the stealer on every reboot.Users should treat every password saved in the browser as stolen, along with cryptocurrency wallet files and login sessions, and keep security software up-to-date.The use of fake Microsoft-signed drivers highlights the need for vigilance and caution in the face of malicious software.
Malware campaigns have long been a concern for cybersecurity experts and users alike. Recent revelations, however, have shed light on a particularly insidious tactic employed by attackers: the abuse of Microsoft-signed drivers in their malicious payloads. A recent report from LastPass and Delphos Labs has exposed a fake LastPass Authenticator installer that installs a Windows kernel driver, effectively shutting down antivirus and endpoint detection and response (EDR) tools before a password stealer runs its course.
The fake installer, masquerading as a legitimate LastPass Authenticator download, was found on a GitHub page that ranks high in search results for the terms "LastPass Authenticator download." Clicking the download button leads the victim through several GitHub pages to an attacker server, which serves a large ZIP file containing the malicious payload. The real LastPass Authenticator can be downloaded from lastpass.com and the official app stores, not GitHub.
Upon installation, the fake driver, renamed to Alinubx.sys, carries a list of 145 antivirus and security process names and terminates each one it finds running. The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a signing date of March 2023, years before this campaign. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers checked it in August, and was not on Microsoft's list of blocked drivers.
The malicious driver's primary function is to kill security software, allowing the attackers to collect sensitive data such as saved passwords from over two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram. The data is then packed into a ZIP file and sent to an attacker server.
The driver's lineage and behavior are not the only signs of a potential attack, as the attackers also impersonate pages for at least 40 brands, including a near-identical second fake page for a "macOS LastPass" product. Fake GitHub repositories delivering this family of stealers are not new, as Trend Micro documented the BoryptGrab stealer spreading this way in March, and Arctic Wolf reported a separate wave of nearly 300 such repositories in July.
Delphos assesses with high confidence that the loader was built with the Cruciferra crypter, a paid tool whose default kill list also holds 145 names and whose driver is interchangeable, and with moderate confidence that the stealer, which LastPass calls Rapuncel, is a relative of BoryptGrab rather than the same build. The behavior of the malicious driver is a prime example of the "bring your own vulnerable driver" (BYOVD) technique, a known technique used by attackers to gain access to systems.
The attack vector used here is an example of a malicious driver exploiting the trust of the system by loading a driver signed through the Microsoft Windows Hardware Compatibility Publisher chain, a process that has been scrutinized for its vulnerability. This method of attack highlights the need for vigilance and caution in the face of malicious software, as well as the importance of keeping security software up-to-date to prevent the installation of such malicious drivers.
In light of these findings, cybersecurity experts and users are advised to treat every password saved in the browser on the affected machine as stolen, along with any cryptocurrency wallet files, Discord, Steam, and Telegram sessions, and anything in Windows Credential Manager. The stealer copies these out before the driver works begins. The driver stays loaded, re-kills security tools, and re-runs the stealer on every reboot, defeating the tools that would normally clean it up.
In conclusion, the malicious use of Microsoft-signed drivers in malware campaigns is a serious threat that requires immediate attention and action from users and cybersecurity professionals alike. By understanding the tactics employed by attackers and taking steps to protect themselves, individuals can minimize the risk of falling victim to these types of attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Tainted-Trust-The-Alarming-Abuses-of-Microsoft-Signed-Drivers-in-Malware-Campaigns-ehn.shtml
https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html
Published: Mon Sep 21 14:09:28 2026 by llama3.2 3B Q4_K_M
