Sophisticated Cyberattack Weaponizes Fake LastPass Authenticator to Blind Windows Security and Steal Credentials

Security researchers from LastPass and Delphos Labs have uncovered a sophisticated malware campaign that uses a fraudulent LastPass Authenticator installer hosted on GitHub to disable endpoint security software and deploy a powerful password-stealing payload. Disclosed on September 17, the attack highlights the growing danger of threat actors exploiting legitimate administrative tools and search engine optimization tactics to compromise unsuspecting Windows users.

According to the joint findings, the malicious campaign relies on a deceptive GitHub repository disguised as an official LastPass Authenticator download page. This fraudulent page successfully maneuvers through search engine results for queries related to downloading the authentication software, deceiving users into believing they are accessing a legitimate product page. LastPass has firmly clarified that none of its internal infrastructure, corporate systems, or customer vaults were compromised during the incident, emphasizing that the threat actors merely hijacked the company’s trusted name to serve their illicit payload.

When a victim initiates the download from the fake repository, they are redirected through multiple GitHub pages before ultimately reaching an attacker-controlled server. The server delivers a heavily padded ZIP archive ranging between 127 and 148 megabytes in size. Security analysts note that the archives are deliberately bloated with junk files designed to bypass automated security scanners and file-size limitations enforced by certain inspection tools.

Unpacking the archive reveals a renamed copy of a legitimate Microsoft debugging utility, vsdbg.exe, placed alongside a malicious dynamic-link library file named vsdbg.dll. When the unsuspecting user executes the file, Windows unwittingly loads the attacker’s DLL from the same directory through a well-known technique called DLL side-loading. The loader immediately attempts various escalation pathways to acquire elevated administrator privileges, ultimately reaching the SYSTEM level—the highest tier of authority on a Windows operating system—allowing it to install a malicious Windows kernel driver as a system service.

What the driver does, and why Windows trusts it

Operating at the kernel level, the malicious driver functions beneath the operational reach of conventional antivirus programs and endpoint detection and response systems. The researchers identified the driver as Alinubx.sys, which carries a hardcoded blocklist consisting of 145 distinct security and antivirus process names. Upon execution, the driver systematically terminates every matching security process it detects running on the host machine.

Because this termination occurs deep within the operating system kernel, user-mode security solutions are rendered blind and powerless to prevent or even detect the intervention. This methodology mirrors a persistent threat vector known as "bring your own vulnerable driver," or BYOVD, where adversaries leverage legitimately signed but inherently abusable third-party drivers to bypass security controls.

Crucially, the driver in question is officially signed through the Microsoft Windows Hardware Compatibility Publisher trust chain, bearing a digital signing date from March 2023—years prior to the execution of this specific campaign. As researchers pointed out in their technical analysis, Microsoft’s attestation pipeline merely verifies that a driver has successfully traversed a signature validation process; it does not constitute an absolute guarantee that the software is safe or benign.

Although the driver possesses advanced capabilities capable of concealing files, injecting code into foreign processes, and rerouting web traffic, these additional features remained dormant because the attackers omitted the necessary configuration files. Nevertheless, the actions it did execute proved devastating. With endpoint defenses successfully silenced, the associated password stealer immediately went to work. The payload harvested saved credentials from more than two dozen web browsers, targeted cryptocurrency wallet files, and extracted active session tokens for popular communication and gaming platforms including Discord, Steam, and Telegram. Additionally, the stealer scooped up sensitive entries stored within the Windows Credential Manager alongside any local files carrying keywords such as passwords, recovery phrases, or cryptographic seed data.

For browsers like Google Chrome and Microsoft Edge, which incorporate advanced security features like app-bound encryption to thwart unauthorized credential dumping, the stealer deployed an injection technique. By inserting code directly into the browser processes, the malware coerced the applications into decrypting and surrendering the stored credentials. This comprehensive haul of sensitive data was then compressed into an archive and exfiltrated to the attackers’ command-and-control server.

Why nothing caught it

A deeper investigation into the mechanics of the driver revealed that it is a direct, renamed variant of CcProtect.sys, a kernel driver originally associated with a Chinese disk-encryption utility called CnCrypt. This specific driver is already cataloged within public threat-intelligence repositories like LOLDrivers as a known process killer, complete with available proof-of-concept documentation. The original file and the variant share identical product attributes, version numbers, and submitter credentials; only the filenames and internal descriptions were altered by the perpetrators.

This simple renaming tactic drastically reduced the file’s visibility to security vendors. While the known original variant triggered detections from approximately seven out of seventy antivirus engines when sampled in August, the newly renamed driver registered zero detections across the board.

Furthermore, the driver managed to evade Microsoft’s built-in vulnerable driver blocklist. This security mechanism, enabled by default since the rollout of the Windows 11 2022 update, is engineered to block the loading of hazardous drivers based on known file signatures. However, because the blocklist relies on precise file hashes, a renamed or recompiled component generates an entirely new hash that slips past the existing rules. When Delphos Labs researchers evaluated the system on August 20, neither the renamed driver nor its original counterpart appeared on Microsoft’s blocklist.

Delphos formally reported the driver to Microsoft on August 19. Microsoft responded by stating that the behavior did not strictly align with its definition of a security vulnerability, noting that the component is not an official Microsoft product, while directing the researchers toward the distinct channel responsible for evaluating driver blocklist additions. Delphos promptly resubmitted the findings through the designated blocklist channel the same day.

If you ran the fake installer

Security experts emphasize that any machine subjected to this installation routine must be treated as completely compromised at the kernel level. Every credential saved within browsers on the affected system, along with associated cryptocurrency wallets, messaging application sessions, and Windows Credential Manager entries, should be considered permanently stolen.

Victims are strongly advised to modify their compromised passwords using an entirely separate, uninfected device rather than the impacted workstation. Because the malicious driver remains persistently resident within the operating system kernel, it automatically re-terminates security tools and re-executes the stealer upon every subsequent system reboot, effectively neutralizing local remediation attempts. Consequently, security analysts recommend performing comprehensive kernel-level forensic evaluations or executing a complete system wipe and rebuild for any machine that ran the malicious installer.

Where it came from

The fraudulent LastPass GitHub repository was merely one component of a much broader infrastructure campaign. According to LastPass, the primary attacker servers were actively hosting impersonation pages targeting at least 40 distinct global brands. Security teams also identified a nearly identical secondary fake page designed to distribute a malicious macOS variant of the LastPass impersonation, though authorities managed to take it down before it could be fully analyzed.

The distribution of infostealers through malicious GitHub repositories leveraging search engine optimization is an evolving trend within the threat landscape. Similar campaigns have been documented by security firms in recent months, highlighting a persistent strategy by cybercriminals to abuse trusted code-hosting platforms for malware delivery.

Based on their technical analysis, Delphos Labs assesses with high confidence that the loader utilized in this campaign was constructed using the Cruciferra crypter—a commercial tool whose default configuration includes the exact same blocklist of 145 security processes. Additionally, researchers hold moderate confidence that the password-stealing payload, designated by LastPass as Rapuncel, shares genealogical ties with previously observed infostealer families. While the precise total of infected victims remains undetermined, the incident serves as a stark reminder of the sophisticated evasion techniques modern threat actors employ to undermine endpoint defenses.