Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer uses a Microsoft-signed driver to kill EDR, then steals passwords and wallets.
LastPass and Delphos Labs reported a fake LastPass Authenticator installer on GitHub that side-loads a malicious DLL beside a renamed copy of Microsoft's vsdbg.exe. After reaching SYSTEM, it installs Alinubx.sys, a March 2023 Microsoft-signed rename of CnCrypt's CcProtect.sys, which kills 145 antivirus and EDR processes from the kernel. An infostealer then takes passwords from more than two dozen browsers, cryptocurrency wallets, Discord, Steam, and Telegram sessions, plus Windows Credential Manager, and exfiltrates a ZIP. LastPass said its systems and customer vaults were untouched; the driver was still off Microsoft's vulnerable-driver blocklist at the September 17 report and persists across reboots.
- Fake GitHub page LastPass-Authenticator serves padded ZIP installer lures.
- DLL side-loading via vsdbg.dll installs a SYSTEM kernel driver service.
- Alinubx.sys terminates 145 antivirus and EDR processes from kernel mode.
- Stealer collects browser passwords, wallets, chat sessions, and Credential Manager.
- Renamed CnCrypt driver was missing from Microsoft's vulnerable driver blocklist.
- ATT&CK
- T1204.002 Malicious FileT1574.002 DLL Side-LoadingT1562.001 Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1055 Process Injection
- Malware
- Alinubx
- Organizations
- LastPassDelphos LabsMicrosoftGitHub
From the original article
5 min read at thehackernews.com
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.