Fake LastPass Installer Uses Microsoft-Signed Driver to Disable Security Tools
Malicious GitHub repo delivers signed driver that kills antivirus before stealing credentials.
1Malicious GitHub repository
Attackers created a fake GitHub page mimicking LastPass Authenticator downloads, ranking high in search results. The page led to a malicious ZIP file containing a renamed Microsoft debugging tool and a malicious DLL. This DLL side-loading technique bypasses initial security checks by leveraging legitimate Microsoft-signed components. The repository impersonated LastPass branding but was unrelated to the actual company.
2Kernel driver exploitation
The attack installs a kernel driver named Alinubx.sys that terminates 145 security processes from below user-mode detection. Signed through Microsoft's Hardware Compatibility Publisher program in March 2023, the driver evaded VirusTotal detection. It operates using BYOVD (Bring Your Own Vulnerable Driver) technique, where attackers abuse legitimate but vulnerable signed drivers to gain kernel-level access undetected by security software.
3Credential theft mechanism
After disabling security tools, the stealer collects passwords from browsers, cryptocurrency wallets, and apps like Discord and Telegram. For Chrome and Edge's encrypted storage, it injects code to force decryption. All stolen data gets compressed into a ZIP sent to attacker servers. The driver persists through reboots, repeatedly killing security tools and re-running the stealer, making cleanup difficult without complete system reimaging.
4Evasion techniques
Attackers renamed CcProtect.sys (a known malicious driver) to bypass detection, dropping VirusTotal flags from 7/70 to 0/70. Large archive sizes (127-148MB) with junk files evade size-limited scanners. The driver wasn't on Microsoft's vulnerable driver blocklist because its original version wasn't listed either - the blocklist uses file hashes that change with renames. Microsoft declined to classify it as a vulnerability since it's not their component.
5Infrastructure details
The attacker server hosted impersonation pages for 40+ brands beyond LastPass, including a nearly identical fake 'macOS LastPass' page taken down before analysis. The loader likely used Cruciferra crypter (a paid tool with 145-name kill list), while the Rapuncel stealer appears related to March's BoryptGrab campaign. Similar fake GitHub repositories delivered 300+ malicious repos in July according to Arctic Wolf.
6Enterprise security implications
The attack demonstrates how signed driver abuse can completely bypass endpoint detection. Security teams must monitor for driver lineage/behavior rather than specific hashes, as attackers rapidly modify components. The incident highlights gaps in Microsoft's driver certification pipeline and blocklist effectiveness against renamed known-bad drivers. Organizations should treat such compromises as kernel-level breaches requiring forensic analysis.
7Recommended response actions
Affected systems require complete rebuilds due to kernel-level persistence. Users must change all passwords from clean devices and review account activity. Security teams should hunt for driver behaviors matching the 145-process kill list rather than specific filenames. Microsoft's blocklist gap suggests need for additional driver reputation systems beyond hash-based blocking for better protection against BYOVD attacks.
8Broker threat landscape
This campaign reflects growing abuse of software supply chains and trusted platforms like GitHub. Attackers combine multiple evasion techniques: signed components, repository impersonation, large junk files, and process killing. The security community faces challenges in keeping driver blocklists current and preventing abuse of legitimate signing programs. Similar incidents will likely increase as attackers refine these hybrid attack vectors.