Fake LastPass Authenticator Installer Uses Signed Kernel Driver to Disable Security Software
Cybersecurity researchers have uncovered a malicious campaign distributing a fake LastPass Authenticator installer through GitHub that deploys a Windows kernel driver capable of disabling antivirus and other security software before launching an information-stealing malware payload.
Researchers from LastPass and Delphos Labs disclosed the campaign on September 17, 2026. The attackers used a fake GitHub repository designed to impersonate LastPass and attract users searching for the legitimate LastPass Authenticator application.
LastPass confirmed that its own systems, services, and customer vaults were not compromised. The attackers were only abusing the LastPass brand as part of the distribution campaign.
Fake GitHub Page Distributes Malicious Installer
The campaign used a fake GitHub page at github.com/LastPass-Authenticator, which appeared in search results for queries such as "LastPass Authenticator download."
The page was designed to resemble an official LastPass product page. However, the legitimate LastPass Authenticator application is distributed through LastPass and official application stores, not through GitHub.
When a victim clicked the download button, the visitor was redirected through multiple GitHub pages before reaching an attacker-controlled server. The server then delivered a large ZIP archive containing the malicious installer.
Researchers observed ZIP archives measuring approximately 148 MB and 127.9 MB. The files were padded with junk data, likely to bypass security scanners that impose file-size limitations.
DLL Side-Loading Starts the Infection
The downloaded archive contains a renamed copy of Microsoft's legitimate vsdbg.exe debugging tool along with a malicious vsdbg.dll file.
When the executable is launched, Windows loads the malicious DLL from the same directory. This technique is known as DLL side-loading.
The malicious loader then attempts multiple methods to obtain administrator privileges. After gaining elevated access, it reaches the SYSTEM level and installs a malicious kernel driver as a Windows service.
Kernel Driver Disables Security Software
The malicious driver, identified by researchers as Alinubx.sys, operates at the Windows kernel level.
It contains a list of 145 antivirus and security-related process names and can terminate those processes when they are running.
Because the driver operates below normal user-mode security software, it can interfere with antivirus and endpoint detection and response tools from a privileged position.
The technique is known as Bring Your Own Vulnerable Driver, or BYOVD. In this approach, attackers abuse a legitimately signed driver or a vulnerable trusted driver to obtain powerful kernel-level capabilities.
The driver was signed through the Microsoft Windows Hardware Compatibility Publisher signing chain. Its signing date was March 2023.
Researchers emphasized that Microsoft's driver-signing process establishes trust in the software distribution and signing chain, but does not necessarily mean that a driver is safe or free from abuse.
Driver Has Additional Capabilities
The security-process termination functionality was the primary capability observed during the investigation.
Researchers found that the driver also contains capabilities for hiding files, injecting code into other processes, and redirecting network traffic. However, these additional functions require a configuration file that was not included in the observed campaign.
Once security software was disabled, the associated information stealer could collect sensitive information from the compromised system.
The malware targeted:
- Saved passwords from more than two dozen browsers
- Cryptocurrency wallet files
- Discord sessions
- Steam sessions
- Telegram sessions
- Windows Credential Manager data
- Files containing names such as
password,seed, andrecovery
The stolen information was compressed into a ZIP archive and transmitted to an attacker-controlled server.
Stealing Protected Chrome and Edge Passwords
The stealer also targeted password data protected by Chrome and Microsoft Edge.
These browsers use application-bound encryption mechanisms designed to prevent other processes from directly decrypting stored credentials.
To bypass this protection, the malware injects code into the browser and uses the browser's own services to request decryption of stored passwords.
This allows the attacker to obtain credentials that would otherwise be protected from ordinary processes.
Driver Was Already Known
Researchers discovered that Alinubx.sys is a renamed copy of CcProtect.sys, a driver associated with the Chinese disk-encryption product CnCrypt.
The original driver is already listed in the LOLDrivers catalog as a security-risk driver capable of terminating processes. Public proof-of-concept material also exists for the driver.
The researchers found that the original driver had been detected by several antivirus engines, while the renamed version received zero detections on VirusTotal during their August testing.
The driver was also not present on Microsoft's vulnerable driver blocklist at the time of the investigation.
Why Microsoft Did Not Block the Driver
Microsoft's vulnerable driver blocklist is designed to prevent known vulnerable or malicious drivers from loading.
Researchers checked the blocklist on August 20 and found that neither the renamed driver nor the original CcProtect.sys was included.
The blocklist relies heavily on identifying known driver files and hashes. Changing a driver's name or producing a different build can result in a new hash that is not automatically covered by an existing block rule.
Delphos Labs reported the driver to Microsoft on August 19.
Microsoft responded that the behavior did not meet its definition of a security vulnerability because the driver was not a Microsoft component. Researchers were directed to the separate process used to evaluate drivers for potential inclusion in the vulnerable driver blocklist.
What Victims Should Do
Anyone who downloaded and executed the fake LastPass Authenticator installer should treat the affected computer as compromised.
Researchers recommend assuming that passwords stored in browsers, cryptocurrency wallet information, Discord, Steam and Telegram sessions, Windows Credential Manager data, and other targeted files may have been stolen.
Affected users should change their passwords from a separate, clean device and review account activity for suspicious logins or unauthorized actions.
Because the malware operates at the kernel level and can reload the malicious components after reboot, simply attempting to terminate the malware or reinstalling security software may not be sufficient.
Where possible, an affected system should undergo a thorough forensic investigation or be rebuilt from a trusted source.
Indicators for Defenders
Security teams can hunt for behavioral and infrastructure indicators associated with the campaign rather than relying only on the current driver filename.
Potential indicators include:
- Service name:
NvFsFilter - Driver path:
C:\Windows\System32\drivers\nvfsflt64.sys - Signer information containing
Henan Dafeng Software - Signer information containing
CnCrypt - Device path:
\\.\Alinubx - Kernel driver loading followed by termination of security-related processes
Researchers also published a community detection for the identified driver through the LOLDrivers project. However, hash-based detection can become ineffective if attackers modify or rebuild the driver.
Broader Campaign
The fake LastPass page appears to be part of a larger malware distribution operation.
LastPass said the attacker-controlled infrastructure was serving impersonation pages for at least 40 different brands.
A second fake page impersonating a LastPass product for macOS was also identified, although it was taken down before researchers could conduct a detailed analysis.
Fake GitHub repositories have increasingly been used to distribute information stealers by exploiting search engine visibility and user trust in GitHub-hosted projects.
Similar campaigns have previously distributed malware through fake repositories, software installers, gaming tools, and other popular applications.
Researchers from Delphos assessed with high confidence that the loader was built using the Cruciferra crypter, a commercial malware-packing tool whose default configuration includes a similar list of 145 security processes.
The information stealer involved in the campaign is referred to by LastPass as Rapuncel. Researchers assess with moderate confidence that it is related to the BoryptGrab stealer family, although they did not conclude that both are the same build.
The number of confirmed victims remains unknown.
Key Takeaway
The campaign demonstrates how attackers can combine SEO poisoning, fake GitHub repositories, DLL side-loading, privilege escalation, and signed kernel drivers to bypass conventional endpoint protections.
The use of a trusted and signed driver is particularly significant because kernel-level access can allow malware to disable security controls before attempting to steal credentials and other sensitive information.
Users should download security applications only from their official vendor websites or trusted application stores and should avoid installers distributed through unofficial GitHub repositories or third-party download portals.
