An installer posing as the LastPass Authenticator drops a Microsoft-signed kernel driver that silences antivirus and endpoint protection before a password stealer runs.
Delphos Labs and LastPass described the chain on September 17. The lure sits at github.com/LastPass-Authenticator and ranks well for download searches, while the genuine app ships from lastpass.com and the official app stores, never GitHub, and LastPass says its own systems, services and customer vaults were untouched.
A driver Windows already trusted
The archive holds a renamed copy of Microsoft’s vsdbg.exe beside a malicious vsdbg.dll, and the two samples ran to 148 MB and 127.9 MB, padded with junk files that defeat scanner size limits. Windows side-loads the attacker’s DLL from the same folder, and from there the loader climbs to SYSTEM and installs the driver as a service.
The researchers named it Alinubx.sys. Its payload is a list of 145 antivirus and security process names, and every one of them that is running gets terminated. The signature comes from Microsoft’s Windows Hardware Compatibility Publisher chain and is dated March 2023. LOLDrivers already lists the Chinese disk-encryption product CnCrypt as a process killer, and the file here is that product’s CcProtect.sys with only the name changed. The rename dropped detections from 7 of roughly 70 engines to zero.
What to do if it ran
Microsoft’s vulnerable-driver blocklist matches known hashes, so a renamed file slips past it. With defenses down, the stealer LastPass calls Rapuncel lifts saved passwords from more than two dozen browsers, crypto wallet files, Discord, Steam and Telegram sessions, and Windows Credential Manager.
Treat any machine that ran the installer as a kernel-level compromise: change passwords from a clean device, and hunt for a service named NvFsFilter or a driver signed by Henan Dafeng Software.
