Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

1. Executive summary

A fake LastPass Authenticator installer distributed from a GitHub page impersonating LastPass installs a Windows kernel driver, named Alinubx.sys by researchers, that terminates 145 antivirus and EDR products before running a password stealer. The driver is a renamed copy of CcProtect.sys from the Chinese disk-encryption product CnCrypt, signed through the Microsoft Windows Hardware Compatibility Publisher chain in March 2023, and scored zero detections on VirusTotal in August. The stealer, which SecurityWeek names "Rapuncel", harvests saved passwords from more than two dozen browsers, cryptocurrency wallet files, Windows Credential Manager contents, and session data for Discord, Steam and Telegram. LastPass states none of its systems, services or customer vaults were affected; the attackers used its brand as a lure. No named threat actor has a confirmed MITRE profile in the verified reference data, so attribution is unconfirmed. The bottom-line risk for EMEA financial services is credential and session theft on endpoints where security tooling has been silently disabled, with the initial access vector being a user searching for a legitimate security product and downloading a trojanised installer from GitHub.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign is a commodity credential-theft operation against end users via a fake software download; it does not, on the available facts, involve an ICT third-party provider relationship, a supply-chain compromise of a vendor used by financial entities, or a confirmed major incident at a financial entity. If a client confirms an infection on a managed endpoint, DORA Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities) would be triggered by that specific finding, not by this advisory.

3. Technical analysis & attack chain

Confirmed steps, per LastPass and Delphos Labs as reported by The Hacker News and SecurityWeek:

1. The victim searches for terms such as "LastPass Authenticator download" and reaches a fake GitHub page, github.com/LastPass-Authenticator, which ranks in search results and mimics a genuine LastPass product page.
2. Clicking the download button routes through several GitHub pages to an attacker-controlled server, which serves a large ZIP archive. Observed archive sizes were 148 MB and 127.9 MB, padded with junk files so that scanners with size limits skip them.
3. Inside the ZIP is a renamed copy of a genuine Microsoft debugging tool, vsdbg.exe, placed alongside a malicious file named vsdbg.dll. Running the fake installer triggers DLL side-loading: Windows loads the attacker's vsdbg.dll from the same folder.
4. The loader attempts three methods to gain administrator rights, reaches SYSTEM, and installs the kernel driver as a service.
5. The driver, Alinubx.sys, carries a hard-coded list of 145 security process names and terminates each one it finds running. Because it operates from the kernel, user-mode antivirus and EDR tools cannot block or observe the kills.
6. With security software down, the stealer collects saved passwords from more than two dozen browsers, cryptocurrency wallet files, login sessions for Discord, Steam and Telegram, Windows Credential Manager contents, and files named like "password", "seed" or "recovery".
7. For Chrome and Edge, which use Google's app-bound encryption, the stealer injects code into the browser process and requests decryption through the browser's own service, defeating the control. Stolen data is packed into a ZIP and exfiltrated to an attacker server.

Driver provenance and trust. Alinubx.sys is a renamed copy of CcProtect.sys, a driver from the Chinese disk-encryption product CnCrypt that is already listed on the LOLDrivers catalogue as a process killer, with public proof-of-concept code available. The renamed file shares the same product name, version and submitter as the original; only the file name and description changed. That rename dropped VirusTotal detections from 7 of roughly 70 engines for the known original in August to zero for the renamed copy. The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain with a signing date of March 2023, years before the campaign. Delphos checked Microsoft's vulnerable driver blocklist on August 20 and found neither the renamed driver nor the known original on it. The researchers' assessment is direct: Microsoft attestation proves a driver passed through a trust pipeline, it does not prove the driver is safe.

Latent capability. The driver's code can also hide files, inject into other programs and reroute web traffic, but those functions require a configuration file the attackers did not include, so they remained inactive in the observed samples. Treat this as capability, not observed behaviour.

Scope. SecurityWeek reports the operation impersonates at least 40 companies, not only LastPass, and disables 145 security products. The stealer is referred to as "Rapuncel" in that reporting.

Confidence caveat. The technical detail above, including the driver name, the 145-product kill list, the vsdbg.exe/vsdbg.dll side-loading mechanism and the CcProtect.sys lineage, is single-sourced to the LastPass and Delphos Labs research as relayed by The Hacker News and SecurityWeek. No file hashes, C2 domains or IP addresses appear in the available source material. Verify the driver name and file artefacts against the original vendor research before building enforcement actions on them.

4. Mitigation & containment

P1, within 24 hours:

• Search endpoints for the artefacts named in the research: files named vsdbg.dll in the same directory as vsdbg.exe, and any driver file named Alinubx.sys. Quarantine matches and capture the files for analysis.
• Block execution of vsdbg.exe from user-writable paths. The genuine Microsoft debugging tool has no business running from a Downloads folder or temp directory; an application-control rule restricting vsdbg.exe to approved developer paths stops the side-loading chain at step one.
• Hunt for the driver service installation: a new service whose image path points to Alinubx.sys, created by a process running as SYSTEM that spawned from a user-session binary. Review EDR telemetry for the August-to-September window.

P2, within 72 hours:

• Enable and verify Microsoft's vulnerable driver blocklist on all Windows endpoints. Delphos found neither the renamed driver nor the original CcProtect.sys on the blocklist as of August 20, so the blocklist alone does not cover this driver; verify the current list state and treat the blocklist as one layer, not the control.
• Review web-filtering and proxy logs for user traffic to github.com/LastPass-Authenticator and for large ZIP downloads, 100 MB or more, from GitHub-hosted redirect chains. Identify any user who reached the fake page and triage their endpoint for the vsdbg pair and for browser credential store access by non-browser processes.
• Check whether any of the 145 killed security products appear in your estate: if EDR or antivirus processes terminated unexpectedly on any endpoint since August, treat that host as suspect and reimage rather than trust a clean scan, since the kill happens below the tools' visibility.

P3, within 7 days:

• Add a user-awareness item covering software sourcing: the genuine LastPass Authenticator is distributed from lastpass.com and official app stores, never GitHub. Extend the message to the other impersonated brands once the full list of 40 companies is published.
• Assess whether Microsoft Defender application control or an equivalent kernel-level policy can restrict driver loading to an approved list, since the BYOVD technique defeats user-mode controls by design.
• Review browser hardening: enforce Chrome and Edge policies that limit injection into the browser process, and confirm app-bound encryption is enabled, while noting this campaign shows a bypass path through the browser's own decryption service.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The research names files and a driver but provides no hashes, domains, IP addresses or URLs beyond the fake GitHub page, which is a legitimate-domain path and should be handled as a hunting query rather than a blockable indicator.

Behavioural indicators:

6. Detection

rule Fake_LastPass_Installer_VSDBG_Sideload
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-21"
        reference = "https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html"
        description = "Detects the malicious side-loaded DLL from the fake LastPass Authenticator installer campaign. Strings are file and component names reported by LastPass and Delphos Labs."
    strings:
        $dll = "vsdbg.dll" wide ascii
        $exe = "vsdbg.exe" wide ascii
        $driver = "Alinubx.sys" wide ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: Fake LastPass installer kernel driver service creation via vsdbg side-load
id: 00000000-0000-0000-0000-000000000992
status: experimental
description: Detects the service-based kernel driver installation performed by the loader dropped by the fake LastPass Authenticator installer, per LastPass and Delphos Labs research.
references:

    - https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html
    - https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/
tags:

    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1553
logsource:
    product: windows
    service: system
detection:
    selection_service:
        EventID: 7045
        ImagePath|contains: 'Alinubx.sys'
    condition: selection_service
falsepositives:

    - None expected; the driver name is specific to this campaign.
level: critical

The YARA rule keys on the file names reported in the research. No hashes were published, so hash-based detection is not possible from this material; retrieve samples from the original LastPass and Delphos Labs reports to build hash coverage.

7. Sources

• The Hacker News, "Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR", https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html, 2026-09-21
• SecurityWeek, "Fake LastPass Installers Push Kernel-Level EDR Killer, 'Rapuncel' Stealer", https://www.securityweek.com/fake-lastpass-installers-push-kernel-level-edr-killer-rapuncel-stealer/, 2026-09 (accessed 2026-09-21)

8. Adverse Trace position

We assess this as a high-impact commodity campaign rather than a targeted operation against financial services, but the impact on an infected endpoint is severe: total neutralisation of host security tooling followed by credential, session and wallet theft, which is direct material for follow-on fraud and account takeover against both staff and customers. The core lesson for clients is that Microsoft driver signing and the default vulnerable driver blocklist did not stop a known-abusable driver, renamed, from loading with zero antivirus detections, so kernel-level execution controls and application control on user-writable paths are the defences that actually engage this chain. Attribution is unconfirmed: no actor is named in the reporting and no MITRE profile exists in the verified reference data. The technical detail is single-sourced to the LastPass and Delphos Labs research, so we will track the original vendor publications for the full IOC set, the list of 40 impersonated brands and the 145-product kill list, and we will issue an update if Microsoft adds the driver to its blocklist or if hashes and C2 infrastructure are published.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.