Delphos Labs (Organization): news timeline & CVEs

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

A fake LastPass Authenticator installer uses a Microsoft-signed driver to kill EDR, then steals passwords and wallets.

LastPass and Delphos Labs reported a fake LastPass Authenticator installer on GitHub that side-loads a malicious DLL beside a renamed copy of Microsoft's vsdbg.exe. After reaching SYSTEM, it installs Alinubx.sys, a March 2023 Microsoft-signed rename of CnCrypt's CcProtect.sys, which kills 145 antivirus and EDR processes from the kernel. An infostealer then takes passwords from more than two dozen browsers, cryptocurrency wallets, Discord, Steam, and Telegram sessions, plus Windows Credential Manager, and exfiltrates a ZIP. LastPass said its systems and customer vaults were untouched; the driver was still off Microsoft's vulnerable-driver blocklist at the September 17 report and persists across reboots.

The Hacker Newsupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 17:31 UTC · 5d agoMalware in the wild 5 sources

New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

A new infostealer named Rapuncel uses a Microsoft-signed kernel driver to kill 145 security tools and steal data via fake GitHub repositories.

Researchers from LastPass and Delphos Labs uncovered the Rapuncel infostealer campaign, which abuses a legitimate Microsoft-signed kernel driver to terminate security software. Attackers used fake GitHub repositories impersonating LastPass and other companies to distribute the malware. Once installed, Rapuncel disables 145 security processes using a kernel driver (Alinubx.sys) signed by the Microsoft Windows Hardware Compatibility Publisher, then steals sensitive data from browsers, wallets, and system storage. The driver was linked to Henan Dafeng Software and was not on Microsoft's vulnerable driver blocklist.

GBHackersupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 11:36 UTC · 5d agoMalware in the wild 5 sources1

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Hackers are using a Microsoft-signed driver to disable 145 security tools and steal passwords via fake LastPass download pages on GitHub.

A malware campaign tracked as Rapuncel used a Microsoft-signed kernel driver (Alinubx.sys) to disable 145 antivirus and EDR processes before stealing passwords and sensitive data. Attackers created fake GitHub repositories impersonating LastPass Authenticator to distribute the malware via large ZIP archives. The signed driver, a renamed version of CcProtect.sys from Henan Dafeng Software, was not on Microsoft's vulnerable driver blocklist and allowed the malware to bypass security protections. The stolen data included browser credentials, cryptocurrency wallets, and chat tokens, which were exfiltrated to a C2 server.

Cyber Security Newsupdated Sep 23, 08:25 UTC · 4d agofirst Sep 21, 11:30 UTC · 5d agoMalware in the wild 5 sources

Delphos Labs

Timeline3 articles

Appears with

Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

New Rapuncel Infostealer Abuses Microsoft-Signed Driver to Disable 145 Security Tools

Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords