Security researchers at **LastPass** and **Delphos Labs** uncovered a campaign leveraging a fake **LastPass Authenticator** installer hosted on **GitHub**. If downloaded and executed, this malicious package installs a Windows kernel driver that preemptively disables security software before deploying a password stealer. Crucially, the driver, identified as **Alinubx.sys**, was signed through **Microsoft**'s own hardware-compatibility program. This allowed it to achieve zero detections on **VirusTotal** when checked in August and bypass **Microsoft**'s default driver blocklist at the time. **LastPass** has confirmed that none of its internal systems, services, or customer password vaults were compromised, emphasizing that attackers merely exploited its brand name as a lure. ### The Deceptive Lure The attack begins with a meticulously crafted fake **GitHub** page (`github.com/LastPass-Authenticator`) designed to mimic an official **LastPass** product page. This page was optimized to rank in search results for terms like "**LastPass Authenticator** download." Clicking the download button redirects users through a series of **GitHub** pages, ultimately leading to an attacker-controlled server. This server delivers a large ZIP file, deliberately padded with junk data (up to 148 MB) to potentially evade size-limited scanners. It's important to note that the legitimate **LastPass Authenticator** is exclusively available from `lastpass.com` and official app stores, not **GitHub**. ### Infection Chain and Kernel-Level Access Inside the malicious ZIP file, victims find a renamed copy of a legitimate **Microsoft** debugging tool, `vsdbg.exe`, alongside a malicious DLL named `vsdbg.dll`. When the fake installer runs, Windows' DLL side-loading mechanism causes it to load the attacker's DLL from the same folder. The loader then attempts to escalate privileges, utilizing three methods to achieve **SYSTEM**-level access – the highest privilege on a Windows machine. With elevated rights, it installs the kernel driver as a service. ### Alinubx.sys: The Antivirus Killer Operating at the kernel level, the **Alinubx.sys** driver functions below where most antivirus and Endpoint Detection and Response (**EDR**) tools operate. It contains a hardcoded list of 145 antivirus and security process names. Upon execution, it systematically terminates each identified security process. This technique, known as "Bring Your Own Vulnerable Driver" (**BYOVD**), leverages a legitimately signed but abusable driver to gain deep system access. The driver's signing date was March 2023, predating the campaign. Researchers highlighted that **Microsoft** attestation confirms a driver has passed through a trusted pipeline, but it does not inherently guarantee the driver's safety. While the driver's code is capable of hiding files, injecting into other programs, and rerouting web traffic, these functionalities require a configuration file that the attackers did not include in this specific campaign. Its primary role here was to disable security software. ### The Password Stealer: Rapuncel With security software neutralized, the embedded stealer, which **LastPass** refers to as **Rapuncel**, activates. It targets saved passwords from over two dozen browsers, cryptocurrency wallet files, and login sessions for applications like **Discord**, **Steam**, and **Telegram**. It also extracts contents from **Windows Credential Manager** and files with names such as "password," "seed," or "recovery." For browsers like **Chrome** and **Edge**, which employ app-bound encryption, the stealer injects code directly into the browser process, compelling the browser's own service to decrypt the stored passwords. The exfiltrated data is then compressed into a ZIP file and transmitted to an attacker-controlled server. ### Evasion and Blocklist Challenges The driver, **Alinubx.sys**, is a renamed version of **CcProtect.sys**, a known driver from the Chinese disk-encryption product **CnCrypt**. **CcProtect.sys** is already listed on the **LOLDrivers** catalog as a process killer with public proof-of-concept code. While the original **CcProtect.sys** showed 7 detections on **VirusTotal**, the renamed **Alinubx.sys** registered zero detections due to the file name and description change. **Microsoft**'s vulnerable driver blocklist, enabled by default since the **Windows 11 2022** update, prevents listed drivers from loading. However, **Delphos Labs** found that neither the renamed driver nor its known original was on this blocklist as of August 20. The blocklist primarily relies on known file hashes, meaning a renamed or recompiled driver generates a new hash, bypassing existing entries. **Delphos** reported the driver to **Microsoft** on August 19. **Microsoft** responded that the behavior did not meet its definition of a security vulnerability because the driver is not a **Microsoft** component. They directed researchers to a separate channel for blocklist consideration, where **Delphos** resubmitted the information. ### If You Suspect Infection If you believe you may have run this fake installer, immediate action is critical: * **Assume Compromise:** Treat every password saved on the affected machine as stolen, along with any cryptocurrency wallet files, **Discord**, **Steam**, and **Telegram** sessions, and data within **Windows Credential Manager**. * **Password Reset:** Change all compromised passwords from a separate, trusted, clean device. Do not use the potentially infected machine for this. * **Account Review:** Scrutinize account activity for any unauthorized actions. * **System Rebuild:** The driver persists across reboots, continuously killing security tools and re-running the stealer. A machine that executed this payload should be considered a kernel-level compromise. Where possible, perform a kernel-level forensic analysis or, ideally, rebuild the system from scratch. ### Indicators for Defenders Researchers advise hunting for the driver's lineage and behavior rather than relying solely on file names, as these can be easily altered. Key indicators include: * **Service:** A service created as `NvFsFilter`. * **File:** A driver written to `C:\Windows\System32\drivers\nvfsflt64.sys`. * **Signer:** A driver with signing details naming **Henan Dafeng Software** or containing "**CnCrypt**." * **Device:** The path `\\.\Alinubx`. * **Behavior:** A driver load immediately followed by the termination of security processes. A community detection for the specific driver is available on **LOLDrivers**, though it matches by hash and is susceptible to evasion if the file changes. Comprehensive indicators are provided in the joint report from **LastPass** and **Delphos Labs**. ### Broader Campaign Context The **LastPass** impersonation was part of a broader campaign. The attacker's server hosted fake pages for at least 40 brands, and a near-identical fake page for a "macOS **LastPass**" product was also observed and taken down. Fake **GitHub** repositories distributing this family of stealers are not new; **Trend Micro** documented the **BoryptGrab** stealer spread via this method in March, and **Arctic Wolf** reported a wave of nearly 300 such repositories in July. **Delphos** assesses with high confidence that the loader was built using the **Cruciferra crypter**, a commercial tool with a default kill list of 145 names and an interchangeable driver. They also have moderate confidence that the stealer, **Rapuncel**, is related to **BoryptGrab** rather than an identical build. The total number of victims remains unknown.