On September 17, researchers from LastPass and Delphos Labs unveiled a concerning discovery regarding a counterfeit LastPass Authenticator installer hosted on GitHub. This malicious software, masquerading as a legitimate application, installs a Windows kernel driver designed to disable antivirus and other security measures prior to executing a password-stealing operation if a user unwittingly downloads and runs it.
The driver in question, signed through Microsoft’s hardware compatibility program, initially scored zero detections on VirusTotal during checks conducted in August. Notably, it was absent from Microsoft’s list of blocked drivers. LastPass reassured users that their systems, services, and customer vaults remained untouched, emphasizing that the attackers merely appropriated their brand name.
The deception begins with a fraudulent GitHub page (github.com/LastPass-Authenticator) that appears prominently in search results for terms like “LastPass Authenticator download,” mimicking a genuine LastPass product page. When users click the download button, they are redirected through multiple GitHub pages to an attacker-controlled server, which then serves a sizable ZIP file. It is crucial to note that the authentic LastPass Authenticator is available solely from lastpass.com and official app stores, not GitHub.
Within the ZIP file lies a renamed version of a legitimate Microsoft debugging tool, vsdbg.exe, alongside a malicious file named vsdbg.dll. Upon execution of the fake installer, Windows loads the attacker’s DLL using a technique known as DLL side-loading. The loader attempts three different methods to gain administrator rights, ultimately achieving SYSTEM-level access—the highest privilege on a Windows machine—and installs the kernel driver as a service.
What the driver does, and why Windows trusts it
The kernel driver operates below the level where antivirus and endpoint detection tools function. Identified by researchers as Alinubx.sys, this driver contains a list of 145 antivirus and security process names, systematically terminating each one it detects. This operation occurs from the kernel level, rendering user-mode security tools incapable of blocking or detecting the termination.
Employing a legitimately signed but exploitable driver to gain such access is a recognized tactic known as bring your own vulnerable driver (BYOVD). The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a signing date of March 2023, predating this malicious campaign. As the researchers aptly noted, “Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe.”
While the kill list was the only functionality executed in this instance, the driver possesses additional capabilities, including file hiding, program injection, and web traffic rerouting. However, these features require a configuration file that the attackers did not provide, leaving them dormant.
Nonetheless, the actions taken were sufficient. With security measures disabled, the stealer harvested saved passwords from over two dozen browsers, cryptocurrency wallet files, and login sessions for platforms such as Discord, Steam, and Telegram, as well as data from Windows Credential Manager and files labeled “password,” “seed,” or “recovery.” For browsers like Chrome and Edge, which utilize Google’s app-bound encryption to prevent such theft, the stealer injects code into the browser and prompts the browser’s own service to decrypt the passwords. The stolen data is then compressed into a ZIP file and dispatched to an attacker-controlled server.
Why nothing caught it
The driver is a renamed variant of CcProtect.sys, a component from the Chinese disk-encryption product CnCrypt, already cataloged on LOLDrivers as a process killer, complete with public proof-of-concept code. Both versions share the same product name, version, and submitter; only the file name and description differ.
This renaming effectively evaded antivirus detection: the original driver was flagged by 7 out of approximately 70 engines in August, while the renamed version garnered zero detections. The situation regarding the blocklist is distinct; Microsoft’s vulnerable driver blocklist, enabled by default since the Windows 11 2022 update, prevents listed drivers from loading. Delphos confirmed on August 20 that neither the renamed driver nor the original was present on this list. The renaming did not circumvent the blocklist, as the original had never been included.
The blocklist relies on known file hashes, and a renamed or recompiled driver generates a new hash that is not accounted for. As of the September 17 report, Alinubx.sys remained absent from the blocklist.
Delphos initially reported the driver to Microsoft on August 19. In response, Microsoft stated that the behavior did not constitute a security vulnerability, as the driver is not a Microsoft component, and directed the researchers to a separate channel for blocklist consideration. Delphos resubmitted the report on the same day.
If you ran the fake installer
For individuals who may have executed the counterfeit installer, it is imperative to treat every password saved in the browser on that machine as compromised, along with any cryptocurrency wallet files, Discord, Steam, and Telegram sessions, and data stored in Windows Credential Manager. The stealer extracts this information before the driver executes its operations.
Users should change these passwords from a separate, secure device, not the affected one, and carefully review account activity for any unauthorized actions. The driver remains loaded, capable of re-disabling security tools and re-executing the stealer upon every reboot, thereby thwarting typical cleanup efforts.
A machine that has run this payload should be regarded as experiencing a kernel-level compromise and, where feasible, should undergo a kernel-level forensic examination or be completely rebuilt.
What defenders can hunt for
Researchers recommend focusing on the driver’s lineage and behavior rather than a specific file name, as operators can easily rename the file again. Key indicators to monitor include:
- Service: a service created as NvFsFilter
- File: a driver located at C:WindowsSystem32driversnvfsflt64.sys
- Signer: a driver signed by Henan Dafeng Software or containing “CnCrypt”
- Device: the path .Alinubx
- Behavior: a driver load followed by the termination of security processes
A community detection for the specific driver is available on LOLDrivers, although it matches by hash and thus shares the same vulnerability if the file changes. Comprehensive indicators are detailed in the joint report.
Where it came from
The LastPass page is merely one of numerous lures employed by the attackers. The server in question has been reported to serve impersonation pages for at least 40 different brands, according to LastPass, with a nearly identical second fake page for a “macOS LastPass” product being taken down before further investigation could occur.
Fake GitHub repositories facilitating the distribution of this family of stealers are not a novel phenomenon; Trend Micro documented the BoryptGrab stealer being spread in a similar fashion as early as March, while Arctic Wolf reported a separate wave of nearly 300 such repositories in July.
Delphos expresses high confidence that the loader was constructed using the Cruciferra crypter, a paid tool whose default kill list also includes 145 names, and with moderate confidence that the stealer, referred to by LastPass as Rapuncel, is a relative of BoryptGrab rather than an identical build. The exact number of individuals infected remains unknown, as the report does not provide a victim count.
