Signed Driver, Dead AV: A Fake LastPass Trap

A GitHub page dressed up as the LastPass Authenticator download is not what it appears to be. According to research from LastPass and Delphos Labs published on September 17, the installer pushes a Windows kernel driver that disables antivirus and endpoint security software, clearing the way for a password stealer to run.

LastPass says its own systems, services, and customer vaults were never touched. The attackers simply borrowed the company's name to lend the download an air of legitimacy.

The Lure Ranks in Search

The campaign does not rely on a clever email. Instead, it leans on a fake GitHub page at github.com/LastPass-Authenticator that surfaces in search results for queries like "LastPass Authenticator download" and mimics a genuine product page. Anyone clicking the download button is bounced through several GitHub pages before landing on an attacker-controlled server, which hands back a bulky ZIP archive.

The legitimate LastPass Authenticator is distributed through lastpass.com and the official mobile app stores — not through GitHub. That distinction alone is enough to spot the fake, but the page's design is built to keep visitors from pausing to check.

The archives examined by the research teams weighed 148 MB and 127.9 MB, inflated with junk files. The padding is deliberate: scanners that impose file-size limits will skip the archive rather than unpack it.

A Real Debugger, a Fake Neighbor

Inside the ZIP sits a renamed copy of vsdbg.exe, a genuine Microsoft debugging tool. Beside it is a malicious file called vsdbg.dll. When the counterfeit installer runs, Windows pulls the attacker's DLL from the same directory, a technique known as DLL side-loading. From there, the loader makes three separate attempts to escalate to administrator rights, reaching SYSTEM — the highest privilege level on a Windows machine — and registers the kernel driver as a service.

Because a kernel driver executes below the layer where antivirus and EDR tools operate, those user-mode defenses cannot see the kill coming or stop it. Loading a legitimate but abusable driver for that purpose is a known tactic called bring your own vulnerable driver, or BYOVD, which The Hacker News has covered before.

145 Names on a Kill List

The driver — named Alinubx.sys by the researchers — carries a list of 145 antivirus and security process names and terminates each one it finds running. That kill list is the only part of the driver that actually executed in this campaign. Its code is also capable of hiding files, injecting into other processes, and rerouting web traffic, but those functions require a configuration file the attackers did not include, so they remained dormant.

What did run was sufficient. With security software disabled, the stealer harvested saved passwords from more than two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram, along with the contents of Windows Credential Manager and files whose names resemble "password," "seed," or "recovery."

For Chrome and Edge, which rely on Google's app-bound encryption specifically to block this kind of extraction, the stealer injects code into the browser and asks the browser's own service to decrypt the passwords. The collected data is packed into a ZIP and sent to an attacker server.

Signed in 2023, Trusted Ever Since

The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a signing date of March 2023 — years before this campaign. That signature is the crux of the problem, as the researchers put it.

"Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe."

— the researchers at LastPass and Delphos Labs

When the researchers checked the file on VirusTotal in August, it returned zero detections. It was also absent from Microsoft's list of blocked drivers.

A Rename Erased the Detections

The driver is a renamed copy of CcProtect.sys, a component of the Chinese disk-encryption product CnCrypt that is already listed on the LOLDrivers catalog as a process killer, complete with public proof-of-concept code. The two files share the same product name, version, and submitter; only the file name and description were altered.

That cosmetic change was enough to wipe the file's antivirus detections. The known original drew flags from 7 of about 70 engines in August, while the renamed driver drew none.

The blocklist tells a separate story. Microsoft's vulnerable driver blocklist, enabled by default since the Windows 11 2022 update, prevents listed drivers from loading at all. Delphos checked it on August 20 and found neither the renamed driver nor the known original on it. The rename did not sneak past the blocklist — the original was never on it to begin with.

The blocklist matches known file hashes, so a renamed or recompiled driver generates a new hash the list does not carry. As of the September 17 report, Alinubx.sys was still not on the blocklist.

Delphos reported the driver to Microsoft on August 19. Microsoft replied that the behavior does not meet its definition of a security vulnerability, because the driver is not a Microsoft component, and directed the researchers to the separate channel that evaluates drivers for blocklist inclusion. Delphos resubmitted the same day.

What to Do If It Ran

Anyone who executed the fake installer should assume every password saved in the browser on that machine is compromised, along with any cryptocurrency wallet files, Discord, Steam, and Telegram sessions, and anything stored in Windows Credential Manager. The stealer copies this data out before the driver work even begins.

Passwords should be changed from a separate, clean device — not the affected one — and account activity should be reviewed for anything the owner did not do. The driver remains loaded, re-kills security tools, and re-runs the stealer on every reboot, which defeats the tools that would ordinarily clean up an infection.

A machine that ran this payload should be treated as a kernel-level compromise and, where feasible, given a kernel-level forensic examination or rebuilt from scratch.

Hunting the Lineage, Not the Name

The researchers advise defenders to hunt for the driver's lineage and behavior rather than a single file name, because the operators can rename it again exactly as they did here. Signs to watch for:

• Service: a service created as NvFsFilter
• File: a driver written to C:\Windows\System32\drivers\nvfsflt64.sys
• Signer: a driver whose signing details name Henan Dafeng Software or contain "CnCrypt"
• Device: the path \\.\Alinubx
• Behavior: a driver load followed by security processes being killed

A community detection for the exact driver is published on LOLDrivers, though it matches by hash and therefore shares the same weakness once the file changes. Full indicators are in the joint report.

One Page Among Forty Brands

The fake LastPass page was one of many lures. The attacker server was serving impersonation pages for at least 40 brands, according to LastPass, and a near-identical second fake page for a "macOS LastPass" product was taken down before the team could examine it.

Fake GitHub repositories delivering this family of stealer are not new. Trend Micro documented the BoryptGrab stealer spread this way in March, and Arctic Wolf reported a separate wave of nearly 300 such repositories in July.

Delphos assesses with high confidence that the loader was built with the Cruciferra crypter, a paid tool whose default kill list also holds 145 names and whose driver is interchangeable. It assesses with moderate confidence that the stealer — which LastPass calls Rapuncel — is a relative of BoryptGrab rather than the same build. How many people were infected is unknown; the report provides no victim count.

Why the Signature Is the Story

The mechanics here are not exotic. A poisoned search result, a side-loaded DLL, an escalation to SYSTEM — each step has been seen before. What makes this campaign worth attention is the trust chain it exploits: a driver signed through Microsoft's hardware-compatibility pipeline in March 2023 still loaded without complaint years later, because the signature did its job even though the binary did not deserve it.

For defenders, the practical takeaway from the source material is that hash-based blocklists and file-name detections lag behind operators who rename and repackage their tooling. Behavior — a driver load followed by security processes dying — is what the researchers recommend watching for. For users, the lesson is narrower and more concrete: download authenticators from official sources, and if this installer was ever run on a machine, treat that machine's credentials and wallet files as gone. The source does not quantify how many victims there are, which means the true reach of this campaign remains unknown.