Fake LastPass Installer Uses Signed Driver to Kill Security Tools

A fraudulent version of the LastPass Authenticator is circulating on GitHub, designed to disable security software before stealing user credentials. Researchers from LastPass and Delphos Labs identified the tool on September 17, noting that it uses a legitimate Microsoft-signed driver to evade detection.

The malware targets users who download the fake installer from a search-optimized GitHub page. Once executed, it installs a kernel driver that terminates antivirus and endpoint detection programs, clearing the way for a password stealer to access sensitive data. LastPass confirmed that its own systems and customer vaults remain secure, as the attackers only used the brand name for deception.

Deceptive GitHub page mimics official download

The attack begins with a fake GitHub repository that ranks high in search results for legitimate LastPass downloads. The page mimics the appearance of an official product, directing users to an attacker-controlled server rather than the official lastpass.com website or app stores. This initial confusion is critical, as the real authenticator is never distributed through GitHub.

Users who click the download button receive a large compressed file, often padded with junk data to bypass scanner size limits. Inside, the payload includes a renamed copy of a Microsoft debugging tool alongside a malicious library file. This setup exploits a technique known as DLL side-loading, where Windows loads the attacker's code from the same folder as a trusted executable.

Signed driver kills security software

The core of the attack is a kernel driver named Alinubx.sys, which operates at a system level below standard security tools. Because it runs in the kernel, antivirus software cannot easily block its actions. The driver contains a list of 145 security process names and systematically terminates them, effectively blinding the system to the subsequent theft of credentials.

This technique, known as bring your own vulnerable driver, relies on the fact that Microsoft signs drivers through its hardware compatibility program. While the signature proves the driver passed a trust pipeline, it does not guarantee safety. The specific driver used here was signed in March 2023, years before this campaign, and was not on Microsoft's blocklist when researchers checked it in August.

Zero detections evade antivirus engines

The driver is a renamed copy of CcProtect.sys, a component from a Chinese disk-encryption product already known for its process-killing capabilities. By changing the file name and description, the attackers altered the digital fingerprint of the file. As reported by The Hacker News, this modification resulted in zero detections on VirusTotal, compared to seven detections for the original file.

With security software disabled, the stealer harvests passwords from over two dozen browsers, cryptocurrency wallets, and login sessions for platforms like Discord and Steam. It also accesses Windows Credential Manager and files with keywords like password or seed. For browsers using app-bound encryption, the malware injects code to force the browser to decrypt the data itself before exfiltrating it to an attacker server.