Sophisticated Fake LastPass Authenticator Campaign Deploys Kernel-Level BYOVD Malware to Disable Endpoint Security and Harvest Credentials
A deceptive cyberespionage and credential-theft campaign leveraging a sophisticated software supply-chain poisoning technique has been uncovered by threat intelligence researchers at LastPass and Delphos Labs. Detailed in a joint security advisory released on September 17, the attack vector involves a malicious, heavily optimized GitHub repository masquerading as an official distribution channel for the LastPass Authenticator application. Once downloaded and executed by unsuspecting users seeking multi-factor authentication tools, the malicious payload initiates a multi-stage execution chain that deploys a legitimately signed Windows kernel driver. This driver systematically terminates competing endpoint detection and response (EDR) agents and antivirus software at the deepest layers of the operating system before deploying an advanced information-stealing malware payload known internally as "Rapuncel."
Despite the severity of the compromise, enterprise and consumer security providers have confirmed that LastPass corporate infrastructure, services, and customer password vaults remained entirely uncompromised. The threat actors behind the operation merely misappropriated the LastPass brand identity to fabricate a high-trust lure, ranking high in search engine results through malicious search engine optimization (SEO) tactics. The incident has once again cast a harsh spotlight on systemic vulnerabilities within digital software signing ecosystems, particularly the enduring threat posed by Bring Your Own Vulnerable Driver (BYOVD) attack vectors that weaponize trusted enterprise utilities against the systems they were designed to protect.
Anatomy of the Attack: From Phishing Lure to Kernel Compromise
The operational lifecycle of the attack begins on a malicious GitHub page hosted at github.com/LastPass-Authenticator. Carefully crafted to mimic authentic vendor branding, user interface layouts, and documentation standards, the fraudulent repository successfully manipulated search engine algorithms to capture high-intent traffic looking to download the legitimate LastPass Authenticator. When visitors clicked the prominent download links embedded within the deceptive page, they were systematically redirected through a series of intermediate GitHub routing pages before landing on an external command-and-control (C2) server controlled by the threat actors.
Rather than delivering a harmless installation package, the server served a bloated ZIP archive ranging in size from approximately 128 MB to 148 MB. Security analysts discovered that this massive file size was artificially inflated using large volumes of junk data padding—a deliberate evasion tactic designed to bypass file-size inspection thresholds enforced by automated malware scanners and email security gateways, which frequently skip deep inspection of oversized compressed archives to conserve system resources.
Decompressing the archive reveals a carefully engineered payload consisting of a renamed copy of vsdbg.exe, a legitimate Microsoft Visual Studio debugging tool, accompanied by a malicious dynamic-link library (vsdbg.dll). When the victim executes the deceptive installer, Windows naturally loads the attacker’s malicious DLL from the local directory—a classic persistence and execution technique known as DLL side-loading.
Leveraging this execution context, the loader immediately attempts to escalate privileges across multiple vectors until it achieves NT AUTHORITYSYSTEM, the highest privilege level available within the Windows operating system architecture. Upon securing system-level privileges, the loader deploys and activates a malicious Windows kernel driver as a persistent system service.
The Mechanics of the Kernel-Level EDR Neutralization
The cornerstone of the attack relies on the deployment of a kernel driver, designated by researchers as Alinubx.sys, which operates in Ring 0—the lowest level of operating system privilege. Because security software such as antivirus agents and EDR platforms typically operate in user mode (Ring 3) or utilize supported kernel callbacks that can theoretically be overridden, a rogue driver running at a deeper kernel level possesses the absolute authority to silence competing processes before they can detect or intercept malicious activity.
Forensic analysis revealed that Alinubx.sys is a direct, renamed derivative of CcProtect.sys, a kernel driver originally associated with a Chinese commercial disk-encryption product named CnCrypt. The original driver is already cataloged within public threat intelligence repositories, such as the LOLDrivers project, due to its inherent capability to terminate arbitrary processes. By simply altering the filename and file description while retaining the original product metadata, versioning, and structural integrity, the threat actors successfully stripped the file of existing signature-based detections. When scanned on platforms like VirusTotal in August, the renamed variant registered a pristine zero-detection score, whereas the known original driver was flagged by multiple security engines.
Inside the binary code of the driver lies a hardcoded blocklist containing exactly 145 unique process names corresponding to mainstream antivirus, firewall, and endpoint protection solutions. Upon initialization, the kernel driver systematically enumerates running system processes and terminates any matching security agent. Although the driver’s source code contained dormant capabilities for stealth file hiding, process injection, and network traffic rerouting, these features remained inactive because the attackers omitted the necessary configuration files. Nevertheless, the successful execution of the process-termination routine was entirely sufficient to create an unobstructed operating environment for the secondary payload.
The Rapuncel Infostealer: Comprehensive Data Harvesting
With all defensive monitoring capabilities successfully neutralized at the kernel level, the secondary payload—identified by LastPass as the "Rapuncel" infostealer—commences aggressive data harvesting operations. Operating without fear of interruption, the stealer systematically sweeps the compromised host for sensitive credentials, cryptographic assets, and session tokens.
The targeted data repositories include:
- Saved credentials and autocomplete histories across more than two dozen distinct web browsers.
- Local configuration files and private keys associated with multiple cryptocurrency wallet applications.
- Active authentication tokens and session data for popular desktop communication and gaming platforms, including Discord, Steam, and Telegram.
- Sensitive records stored within the Windows Credential Manager.
- Local files bearing high-value nomenclature such as "password," "seed," "recovery," or "backup."
For modern browsers like Google Chrome and Microsoft Edge—which implement robust security measures such as app-bound encryption to prevent offline credential theft—the stealer deploys advanced evasion techniques. Rather than attempting to decrypt encrypted storage vaults directly from disk, the malware injects code into the active browser process, compelling the browser’s own internal service routines to decrypt and hand over the sensitive data. Once collected, all harvested information is aggregated, compressed into a ZIP archive, and exfiltrated over HTTPS to the attacker-controlled C2 infrastructure.
Evasion of Defenses and the BYOVD Dilemma
The campaign highlights a persistent, systemic vulnerability in modern operating system design: the abuse of legitimate software attestation pipelines. The kernel driver deployed in this attack was digitally signed through the official Microsoft Windows Hardware Compatibility Publisher program, bearing a valid attestation timestamp from March 2023.
This technique, universally known as Bring Your Own Vulnerable Driver (BYOVD), exploits the reality that a digital signature issued by a trusted certification authority proves only that a binary has passed through a validation pipeline—it provides no intrinsic guarantee regarding the behavioral safety or intent of the code. Microsoft’s official stance, communicated to Delphos Labs following reports filed on August 19, maintains that a legitimately signed driver behaving maliciously does not meet the strict corporate definition of a software vulnerability, provided the driver itself is not a native Microsoft component. Instead, Microsoft directs researchers toward the Vulnerable Driver Blocklist channel.
However, the blocklist mechanism itself faces operational limitations. Maintained to prevent known malicious or vulnerable drivers from loading, the blocklist relies primarily on cryptographic file hashes. Because the threat actors simply renamed and slightly recompiled an existing utility (CcProtect.sys), the resulting binary generated an entirely novel file hash that bypassed existing static block rules. As of the publication of the joint security briefing on September 17, the specific driver variant Alinubx.sys remained absent from the default Windows vulnerable driver blocklist.
Broader Campaign Infrastructure and Attribution Insights
Subsequent investigations into the broader campaign infrastructure revealed that the LastPass-themed GitHub repository was merely a single node in a much larger, automated distribution network. According to threat intelligence disclosures from LastPass, the primary attacker-controlled C2 servers were actively hosting identical impersonation pages targeting at least 40 prominent global software brands and corporate entities. A secondary, nearly identical repository configured to distribute malicious macOS payloads under the guise of an authentic LastPass macOS utility was successfully identified and taken down by platform administrators before it could achieve widespread distribution.
The utilization of GitHub repositories as a vector for SEO poisoning and malware delivery is part of an escalating industry-wide trend. Similar campaigns have been documented extensively by security researchers throughout the year. In March, Trend Micro detailed the propagation of the BoryptGrab infostealer via poisoned repositories, while Arctic Wolf disclosed a massive wave of nearly 300 malicious GitHub repositories deployed in a coordinated campaign in July.
Based on technical artifacts, code structure, and operational telemetry, Delphos Labs assesses with high confidence that the loader component utilized in the attack was constructed using the "Cruciferra" crypter—a commercial, paid utility characterized by a default termination list containing precisely 145 security process signatures. Furthermore, researchers hold moderate confidence that the Rapuncel infostealer shares structural and lineage ties with the BoryptGrab family, indicating a collaborative or modular ecosystem shared among distinct cybercriminal syndicates.
Mitigation, Remediation, and Recommendations for Defenders
Organizations and individuals who suspect they may have interacted with the fraudulent GitHub repository or executed the fake LastPass Authenticator installer must treat the affected system as a total compromise. Because the malicious kernel driver establishes persistence at the lowest levels of the operating system, re-enabling security tools or attempting manual clean-up procedures is ineffective; the driver reinfects the system and terminates protective software upon every subsequent reboot.
Recommended remediation protocols include:
- Immediate Isolation: Disconnect the compromised machine from all local area networks and the internet to halt ongoing data exfiltration.
- Complete Credential Rotation: Assume that all passwords stored within browsers, messaging platforms, and credential vaults on the affected machine have been compromised. All account credentials must be modified immediately using a separate, verified clean device.
- Hardware-Level Forensics and OS Rebuilding: Due to the installation of an unauthorized kernel-level driver capable of deep system manipulation, standard disinfection is insufficient. Affected systems should be completely wiped, and storage media should ideally undergo low-level reformatting or forensic evaluation before re-deployment.
For enterprise defenders and security operations centers (SOCs), threat hunting strategies must pivot away from static file-name matching and focus instead on behavioral anomalies. Defenders are advised to monitor for unexpected kernel driver installations, anomalous DLL side-loading attempts involving debugging utilities like vsdbg.exe, unusual parent-child process execution chains originating from temporary download directories, and unexpected termination events affecting EDR or antivirus services. Continuous auditing of loaded kernel modules against community-driven intelligence catalogs such as LOLDrivers remains critical in mitigating the persistent threat of BYOVD exploitation.
