Fake LastPass Installer Deploys Signed Driver to Kill Security Tools

Researchers at LastPass and Delphos Labs have identified a fake LastPass Authenticator installer hosted through a GitHub lure that installs a Microsoft-signed Windows kernel driver to disable security products before running a credential stealer. The campaign did not compromise LastPass systems, services or customer vaults; the operators used the company name to make the download appear legitimate.

The malicious archive was delivered from a fake GitHub page, github.com/LastPass-Authenticator, which appeared in searches for terms such as “LastPass Authenticator download.” Visitors who clicked its download button were redirected through several GitHub pages to an attacker-controlled server. LastPass said the genuine Authenticator is available from lastpass.com and official app stores, not GitHub.

Signed driver disables 145 security processes

The ZIP files observed by the researchers measured 148 MB and 127.9 MB and were padded with junk files, apparently to evade scanners with archive-size limits. Each contained a renamed legitimate Microsoft debugging utility, vsdbg.exe, alongside a malicious vsdbg.dll. When Windows loads the executable, the DLL in the same directory is loaded as well, a DLL side-loading technique that starts the attacker's loader.

The loader attempts three elevation methods, reaches SYSTEM privileges and installs its driver as a service. Named Alinubx.sys by the researchers, the driver runs in the Windows kernel and contains a list of 145 antivirus and endpoint detection and response process names. It terminates those processes from below the user-mode level at which many defensive tools operate.

The driver was signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a March 2023 signing date. Delphos found on August 20 that neither Alinubx.sys nor its known original was listed in Microsoft's vulnerable driver blocklist. Microsoft told the researchers that the submitted behaviour did not meet its definition of a security vulnerability because the driver was not a Microsoft component, and directed them to the separate driver-blocklist reporting channel.

Renamed CnCrypt component and credential theft

Alinubx.sys is a renamed copy of CcProtect.sys from the Chinese disk-encryption product CnCrypt. The files share the same product name, version and submitter, while the filename and description differ. CcProtect.sys is listed in LOLDrivers as a process killer and has public proof-of-concept code. In August, the known file drew detections from seven of roughly 70 antivirus engines, while the renamed version drew none.

The driver also contains capabilities to hide files, inject into processes and reroute web traffic, but those functions require a configuration file that was not included in the observed campaign. Its process-killing capability was sufficient to clear the way for the stealer, which collected saved passwords from more than two dozen browsers, cryptocurrency wallet files, Discord, Steam and Telegram sessions, Windows Credential Manager contents, and files with names such as “password,” “seed” or “recovery.”

For Chrome and Edge, the malware injects code into the browser and asks the browser's own service to decrypt credentials protected with Google's app-bound encryption. It then packages the collected data into a ZIP archive and transmits it to an attacker server. LastPass calls the stealer Rapuncel; Delphos assessed with high confidence that the loader used the Cruciferra crypter and with moderate confidence that Rapuncel is related to BoryptGrab.

Response and detection priorities

Anyone who executed the fake installer should consider browser-stored passwords, wallet data, messaging and gaming sessions, and Credential Manager secrets compromised. Passwords should be changed from a separate clean device, while account activity should be reviewed for unauthorized use. Because the driver remains loaded, disables security tools again after reboot and reruns the stealer, the affected system should be treated as a kernel-level compromise and, where possible, rebuilt or examined with kernel-level forensics.

Defenders should hunt for behaviour and driver lineage rather than relying on a single filename. Useful indicators include a service named NvFsFilter, a driver written to C:\Windows\System32\drivers\nvfsflt64.sys, signing details naming Henan Dafeng Software or containing “CnCrypt,” the device path \\.\Alinubx, and a driver load followed by the termination of security processes. The practical business implication is to verify software distribution channels, investigate unexpected kernel-driver installations promptly and plan incident response on the assumption that endpoint protections may have been deliberately neutralised.