Security researchers have identified a fraudulent LastPass Authenticator download campaign that uses a Microsoft-signed Windows driver to disable antivirus and endpoint detection tools before deploying credential-stealing malware.
According to a joint analysis from LastPass and Delphos Labs published September 17, the operation relied on a GitHub page impersonating a LastPass product site. The page appeared in searches for terms such as “LastPass Authenticator download” and redirected visitors through GitHub-hosted content to an attacker-controlled server serving a large ZIP archive. LastPass said its infrastructure, services, and customer vaults were not affected.
The archive contained a legitimate Microsoft debugging executable, vsdbg.exe, alongside a malicious DLL. By abusing DLL side-loading, the attackers caused the trusted executable to load the malicious library. The loader then sought elevated privileges, installed a kernel driver, and used it to terminate security processes.
Signed driver used for defense evasion
The driver, tracked by researchers as Alinubx.sys, reportedly contains a list of 145 antivirus and security-related processes. Running at the kernel level allows it to interfere with protections that operate in user mode. Researchers said the file was signed through Microsoft’s hardware compatibility publishing process but was not included in Microsoft’s vulnerable driver blocklist when examined.
Analysis indicated that the driver was a renamed version of CcProtect.sys, associated with a Chinese disk-encryption product and previously cataloged as an abusable process-killing driver. The campaign used oversized archives, reportedly padded with unnecessary files, which may help avoid scanning systems that impose file-size limits.
Credential theft and response advice
Once endpoint protections were disabled, the malware collected browser-stored passwords, cryptocurrency wallet data, messaging and gaming-session tokens, Windows Credential Manager contents, and files likely to contain recovery phrases or passwords. The researchers said it could also target browser protections through code injection.
- Change passwords from a separate, trusted device if the installer was executed.
- Review account activity, revoke active sessions, and secure cryptocurrency wallets where applicable.
- Treat affected systems as potential kernel-level compromises and consider rebuilding them or conducting specialist forensic analysis.
- Monitor for suspicious driver services, security-process termination, and files associated with the reported driver lineage.
Researchers said the infrastructure also hosted impersonation pages for dozens of other brands, suggesting the LastPass-themed lure was part of a broader credential-theft operation.