Fake LastPass Authenticator Installer Uses Signed Driver to Disable Security Tools and Steal Credentials
Summary
Researchers say a fake LastPass Authenticator installer delivered a signed driver that disabled security tools before stealing passwords, wallet files, and session data. LastPass said its systems and customer vaults were not compromised.
Key points
- A fake GitHub page impersonated a LastPass Authenticator download; LastPass said the real app is available from lastpass[.]com and official app stores, not GitHub.
- The installer used DLL side-loading and attempted to gain administrator rights before installing the Alinubx.sys kernel driver as a service.
- The driver terminated processes for 145 security tools. Researchers said it was a renamed copy of CcProtect.sys, a driver associated with CnCrypt.
- The stealer targeted browser passwords, cryptocurrency wallet files, Discord, Steam and Telegram sessions, Windows Credential Manager, and files with names such as “password” or “seed.”
- Researchers said the driver was Microsoft-signed, was not on Microsoft’s vulnerable driver blocklist when checked, and had zero VirusTotal detections in an August check after renaming.
- Delphos Labs reported the driver to Microsoft on August 19 and resubmitted it for blocklist consideration. The article said it remained absent from the blocklist as of September 17.
- Researchers advised treating affected machines as kernel-level compromises. They said infection numbers were unknown; LastPass reported that its own systems, services, and customer vaults were not affected.
Article Details
- Attack Vectors
- A fake GitHub page impersonating a LastPass Authenticator download led visitors through GitHub pages to an attacker server hosting a large ZIP archive.
- The installer side-loaded a malicious vsdbg.dll alongside a renamed copy of the legitimate vsdbg.exe debugging tool.
- The loader installed the signed Alinubx.sys kernel driver as a service. The driver terminated security processes, after which the stealer collected credentials, wallet files, and session data and sent the data to an attacker server.
- The installer archive was padded with junk files; researchers said the 148 MB and 127.9 MB archives could evade scanners with size limits.
- Defensive Notes
- Researchers advised hunting for the driver’s lineage and behavior rather than relying on a filename. Indicators include a service named NvFsFilter, a driver written to C:WindowsSystem32driversnvfsflt64.sys, signer details naming Henan Dafeng Software or containing “CnCrypt,” the device path .Alinubx, and security-process termination after a driver loads.
- The report said the Microsoft vulnerable driver blocklist did not include either the renamed driver or the known original when checked, and that hash-based matching can miss renamed or recompiled files.
- For a suspected infection, treat passwords, wallet files, sessions, and Windows Credential Manager contents on the affected machine as stolen. Change passwords from a clean device, review account activity, and consider kernel-level forensics or rebuilding the machine.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe stolen data was packed into a ZIP and sent to an attacker server.T1105 · Ingress Tool TransferThe fake download flow led to an attacker server that delivered a ZIP archive containing the installer components.T1204.002 · Malicious FileThe infection began when a victim downloaded and ran the fake installer.T1547.006 · Kernel Modules and ExtensionsThe loader installed a kernel driver as a service, and the article reports that it remained loaded and re-ran after reboot.T1555.003 · Credentials from Web BrowsersThe stealer collected saved passwords from browsers, including Chrome and Edge.T1555.004 · Windows Credential ManagerThe stealer collected contents of Windows Credential Manager.T1562.001 · Disable or Modify ToolsAlinubx.sys terminated security and EDR processes from kernel mode.T1574.002 · DLL Side-LoadingThe fake installer side-loaded malicious vsdbg.dll from the same folder as the renamed vsdbg.exe.
Malware
Vendors
Products
CnCrypt Protect#LastPass #Alinubx.sysDiscordsaved passwords from more than two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram, along with the contents of Windows Credential Manager and files named likeEdgeFor Chrome and Edge, which use Google’s app-bound encryption to stop exactly this, the stealer injects code into the browser and asks the browser’s own service to decrypt the passwords.Google ChromeFor Chrome and Edge, which use Google’s app-bound encryption to stop exactly this, the stealer injects code into the browser and asks the browser’s own service to decrypt the passwords.LastPass AuthenticatorA fake LastPass Authenticator installer on GitHub delivered a signed Windows kernel driver that disabled security tools before a password stealer harvested credentials, wallet files, and session data.Microsoft WindowsA fake LastPass Authenticator installer on GitHub delivered a signed Windows kernel driver that disabled security tools before a password stealer harvested credentials, wallet files, and session data.Steampasswords from more than two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram, along with the contents of Windows Credential Manager and files named like “password,”Telegrammore than two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram, along with the contents of Windows Credential Manager and files named like “password,” “seed,” or