Fake LastPass installer hides driver that kills antivirus

A fake LastPass installer offered on GitHub switches off antivirus and other security software, then steals the passwords saved on the machine it runs on, researchers at LastPass and Delphos Labs said on September 17. The chain begins with a download page and ends with a Windows kernel driver, and LastPass has stated that none of its own systems, services or customer vaults were touched: the attackers only borrowed the company's name.

The lure is a counterfeit GitHub page, github.com/LastPass-Authenticator, which ranks in search results for terms such as "LastPass Authenticator download" and is built to look like a genuine LastPass product page. Pressing the download button does not start an ordinary download: it sends the visitor through several GitHub pages and on to an attacker server, which serves a large ZIP archive. The real LastPass Authenticator is distributed from lastpass.com and the official app stores, not from GitHub. The archives the researchers saw were 148 MB and 127.9 MB, padded with junk files so that scanning services with upload size limits skip them.

Inside the ZIP sits a renamed copy of vsdbg.exe, a genuine Microsoft debugging tool, placed next to a malicious file called vsdbg.dll. When the fake installer runs, Windows loads the attacker's DLL from the same folder instead of the legitimate one, a trick known as DLL side-loading. The loader then tries three different ways to obtain administrator rights, reaches SYSTEM (the highest privilege level on a Windows machine), and installs a kernel driver as a service. A kernel driver is software that runs at the deepest layer of the operating system, below the layer where antivirus programs and endpoint detection and response (EDR) tools work, which is why it can act without being seen by them.

The driver, which the researchers named Alinubx.sys, carries a list of 145 antivirus and security process names and terminates each one it finds running. Because it acts from the kernel, those ordinary (user-mode) security tools cannot block the kill or even observe it. Loading a properly signed but abusable driver to gain that kind of access is a known technique called bring your own vulnerable driver, or BYOVD. The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a signing date of March 2023, years before this campaign. As the researchers put it, "Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe." The kill list is only the part of the driver's code that ran here. The same code can also hide files, inject into other programs and reroute web traffic, but those functions need a configuration file that the attackers did not include, so they stayed off.

With security software down, the stealer collected saved passwords from more than two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam and Telegram, along with the contents of Windows Credential Manager and any files named like "password", "seed" or "recovery". For Chrome and Edge, which use Google's app-bound encryption to stop exactly this kind of theft, the stealer injects code into the browser and asks the browser's own service to decrypt the passwords. The stolen data is packed into a ZIP and sent to an attacker server.

Why nothing caught it. The driver is a renamed copy of CcProtect.sys, a driver from the Chinese disk encryption product CnCrypt that is already listed in the LOLDrivers catalog as a process killer, with public proof-of-concept code. The two files share the same product name, version and submitter; only the file name and description were changed. That single change collapsed detection: the known original was flagged by 7 of about 70 engines in August, while the renamed driver was flagged by none. The rename did not slip past Microsoft's vulnerable driver blocklist, however, because the original was never on it either. The blocklist, switched on by default since the Windows 11 2022 update, matches known file hashes, and a renamed or recompiled driver produces a new hash that the list does not carry. Delphos checked the list on August 20 and found neither version on it, and at the time of the September 17 report Alinubx.sys was still not on it.

Delphos reported the driver to Microsoft on August 19. Microsoft replied that the behaviour does not meet its definition of a security vulnerability, because the driver is not a Microsoft component, and pointed the researchers to the separate channel that considers drivers for the blocklist. Delphos resubmitted there the same day.

What to do if the fake installer was run. Treat every password saved in the browser on that machine as stolen, together with any cryptocurrency wallet files, Discord, Steam and Telegram sessions and anything in Windows Credential Manager, because the stealer copies that data out before the driver work begins. Change those passwords from a separate, clean device rather than the affected one, and review account activity for anything you did not do. The driver stays loaded, kills security tools again and re-runs the stealer on every reboot, so the tools that would normally clean the machine up cannot be relied on. A machine that ran this payload should be treated as a kernel-level compromise and, where possible, given a kernel-level forensic check or rebuilt.

What defenders can hunt for. The researchers advise hunting for the driver's lineage and behaviour rather than for a single file name, since the operators can rename it again as they did here. Signs to watch for include a service created as NvFsFilter; a driver written to C:\Windows\System32\drivers\nvfsflt64.sys; a driver whose signing details name Henan Dafeng Software or contain "CnCrypt"; the device path \\.\Alinubx; and a driver load followed by security processes being killed. A community detection for the exact driver is published on LOLDrivers, though it matches by hash and so shares the same weakness once the file changes. Full indicators are in the joint report.

Where it came from. The LastPass page was one of many lures: the attacker server was serving impersonation pages for at least 40 brands, LastPass said, and a near-identical second fake page for a "macOS LastPass" product was taken down before the team could examine it. Fake GitHub repositories delivering this family of stealer are not new: Trend Micro documented the BoryptGrab stealer spread this way in March, and Arctic Wolf reported a separate wave of nearly 300 such repositories in July. Delphos assesses with high confidence that the loader was built with the Cruciferra crypter, a paid tool whose default kill list also holds 145 names and whose driver is interchangeable, and with moderate confidence that the stealer, which LastPass calls Rapuncel, is a relative of BoryptGrab rather than the same build. How many people were infected is not known; the report provides no victim count.

For organisations that want their ow