Fake LastPass on GitHub Led to an Infostealer That Killed 145 Security Tools

Attackers spoofed LastPass on GitHub, used a Microsoft-signed driver to disable 145 security products, then deployed an infostealer.

Someone impersonated LastPass on GitHub, got users to download a fake authenticator, and ended up killing 145 different antivirus and EDR products using a driver that Microsoft itself had signed. That last part is the one worth sitting with.

LastPass’s Threat Intelligence, Mitigation, and Escalation team spotted the fake GitHub organization on August 13, 2026. It appeared high in search results for “LastPass Authenticator download” and used real LastPass logos and branding to look legitimate. The download page also displayed fake trust badges, including “VirusTotal Approved.” The badges were meaningless and were simply there to make users feel safe enough to download the file.

Once LastPass brought in Delphos Labs for payload analysis, the picture got a lot bigger than one fake page. They found a shared kit actively impersonating more than 40 different companies, all running through the same infrastructure. This wasn’t a one-off phishing attempt, it was a malware-as-a-service operation with LastPass as just one of many skins on the same underlying product.

“LastPass Threat Intelligence, Mitigation, and Escalation (TIME) Team, in partnership with Delphos, identified and disrupted a multi-stage malware delivery campaign impersonating at least 40 companies on GitHub.” reads the report published by LastPass. “The payload it delivered survived controls that were built to stop exactly this, with a Microsoft Windows Hardware Compatibility Publisher chain signature and a clean VirusTotal score. LastPass is internally tracking the infostealer as Rapuncel.”

Worth stating plainly, since brand impersonation attacks like this tend to get misattributed to the company being spoofed. LastPass wasn’t breached here. Its name was borrowed, which is a different and honestly more common problem: attackers don’t need to break into a company, they just need a logo people trust.

“This was opportunistic brand impersonation. No LastPass system, service, or customer vault was involved or compromised. The lure was distributed entirely outside LastPass channels. Official LastPass Authenticator is available through lastpass.com and the official app stores.” continues the report. “GitHub is not a LastPass distribution channel. This was opportunistic use of a recognizable name.”

The download process was more sophisticated than it first appeared. When victims clicked the download button, they were sent through two other GitHub Pages accounts that looked like broken 404 pages but secretly used JavaScript to redirect them to the next step.

A separate server behind Cloudflare then chose where to send the final malware. This meant the attackers could switch to a new malware server without changing the GitHub pages. The endpoint also changed between August 27 and September 10, showing that the attackers were still actively maintaining the campaign.

The ZIP file itself uses an old trick that still works: padding. Two large junk DLLs inflate the archive past the size limit most automated scanners bother checking, so the real malware slips through hidden among plausible looking files. Delphos has seen this exact size-padding move before in an unrelated 55MB stealer sample, so it’s not new, it’s just still effective because scanners haven’t closed that gap.

Once opened, the fake installer was actually a Microsoft debugging tool that had been renamed. It automatically loaded a malicious DLL placed in the same folder. The malware then gained SYSTEM privileges and installed a kernel driver disguised as an NVIDIA component.

The driver had a valid Microsoft Windows Hardware Compatibility Publisher signature. That trusted signature helped it bypass security checks and then disable the antivirus and EDR products installed on the victim’s system.

“The signature was ineffective at halting this campaign because a signature merely asks whether a file matches something already discovered to be malicious. This driver was signed, timestamped, and clean on VirusTotal, and its dangerous twin was hiding behind a different filename. Every signal a signature-based control reads came back green.” continues the report. “The Microsoft signature proves the driver passed through a trust pipeline. It does not prove the driver is safe.”

That’s the whole failure mode in one sentence. The driver was clean on VirusTotal, properly signed, and not on Microsoft’s blocklist, because it wasn’t the same file as the one everyone was already watching for. Delphos traced it back to CcProtect.sys, a known Chinese disk-encryption driver already catalogued on LOLDrivers with public proof-of-concept killer code freely available on GitHub. The attackers just renamed the file to Alinubx.sys, and that single change was enough to dodge every hash-based detection built around the original name.

“A user-mode stealer steals credentials. A trusted kernel driver clears the runway.” continues the report. “This is an abuse-by-design driver rather than a memory-corruption exploit. The process-kill interface appears to be product functionality exposed by a host-defense driver. The control is policy enforcement: block the driver, deny the signer or lineage, or prevent the drop. If the driver is trusted and not blocklisted, administrator rights are enough to install and use it.”

Once the driver killed security software from kernel level, the actual credential theft was almost mundane by comparison. Passwords from more than 25 browsers, wallet files from over 30 crypto apps, Discord tokens, Steam sessions, Telegram data, anything in Windows Credential Manager, screenshots of every connected monitor. For Chrome and Edge specifically, the malware injected code directly into the browser process to call the browser’s own decryption service from the inside, defeating Google’s 2024 app-bound encryption by simply asking nicely from a trusted position.

Delphos flagged the sample to Microsoft on August 19. MSRC responded that the driver behavior doesn’t meet its definition of a security vulnerability, since it’s not a Microsoft-owned component, and redirected the report to the separate blocklist submission channel instead. As of publication, Alinubx.sys still wasn’t on that blocklist. Bureaucracy moves at bureaucracy speed, malware doesn’t wait for it.

The bigger lesson is not just about this campaign. It is about the assumptions that no longer hold. A well-known brand on GitHub does not mean the repository is official. A Microsoft signature does not automatically mean a driver is safe. A clean VirusTotal result does not prove a file is harmless. And a blocklist can only stop threats that have already been identified.

In this case, attackers managed to exploit all four trust assumptions at the same time, using a toolkit that is currently targeting around 40 other companies.

If you or someone on your team downloaded an authenticator or security tool from a GitHub link in the past few weeks, it is worth spending 15 minutes checking the system now. It could save you from a much bigger problem later.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LastPass)

---

---