Fake LastPass Authenticator Installer Hijacks Windows Drivers to Disable Security Tools and Steal Credentials

Enterprises that rely on password managers are now facing a fresh phishing threat. Researchers from LastPass and Delphos Labs have uncovered a campaign that distributes a counterfeit LastPass Authenticator installer via a public GitHub repository. The installer drops a ZIP archive that contains a renamed Microsoft debugging tool (vsdbg.exe) and a malicious dynamic‑link library (vsdbg.dll). When the fake installer runs, Windows loads the attacker‑supplied DLL from the same folder, a technique known as DLL side‑loading, where a legitimate executable unintentionally loads a malicious library that shares its name.

How the malicious installer gains control

The loader first attempts three methods to obtain administrator rights and eventually runs with the SYSTEM account, the highest privilege level on a Windows machine. With those rights it registers a kernel‑mode driver called Alinubx.sys as a Windows service. The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, which means it carries a Microsoft‑issued digital signature and therefore passes basic driver‑signing checks.

What the driver does

Alinubx.sys is a renamed copy of CcProtect.sys, a component of the Chinese disk‑encryption product CnCrypt. Inside the driver is a hard‑coded list of 145 process names belonging to antivirus and endpoint‑detection‑and‑response (EDR) products. Running in kernel space, the driver terminates any of those processes it finds, effectively disabling security software before the next stage of the attack proceeds. Because the driver operates at the kernel level, the termination cannot be blocked by the very tools it is killing.

Data‑stealing payload

With the security suite silenced, the payload activates a password‑stealer that extracts saved credentials from more than two dozen web browsers, cryptocurrency wallet files, and login sessions for Discord, Steam and Telegram. It also reads the Windows Credential Manager, a built‑in store for saved passwords and other secrets. The stolen data is then exfiltrated to the attackers' command‑and‑control servers.

Persistence and evasion

The driver is installed as a persistent service, so it remains loaded across reboots, re‑kills security tools and re‑launches the stealer each time the system starts. The renamed driver evaded detection on VirusTotal, showing zero detections at the time of analysis. Moreover, it was not listed on Microsoft’s vulnerable‑driver blocklist, and Microsoft clarified that the behaviour does not qualify as a security vulnerability because the driver is not a Microsoft component.

Photo by Dan Nelson on Pexels

Official response

LastPass confirmed that none of its own systems, services or customer vaults were compromised. The attackers merely borrowed the LastPass brand to lend credibility to the fake installer.

What organisations should do now

1. Update Windows, Apply the latest cumulative updates to ensure the driver blocklist is current.
2. Verify the blocklist, Check Microsoft’s vulnerable‑driver blocklist for the presence of Alinubx.sys or its hash.
3. Remove the malicious service, Identify and delete the service named NvFsFilter and delete the driver file located at C:\Windows\System32\drivers\nvfsflt64.sys.
4. Perform a kernel‑level forensic analysis, If possible, have a qualified team analyse the kernel state, or rebuild the affected machine from a known‑good image.
5. Reset credentials, From a clean device, change all saved passwords, cryptocurrency wallet keys, and re‑authenticate Discord, Steam and Telegram sessions.
6. Monitor for suspicious drivers, Look for newly created drivers signed by entities containing "Henan Dafeng Software" or "CnCrypt" in the signer details.

Taking these steps will help contain the incident and prevent further credential theft.

Photo by Yan Krukau on Pexels

Key take‑aways - A fake LastPass Authenticator installer is being used to deliver a signed kernel driver that disables security tools. - The driver kills 145 antivirus/EDR processes from kernel space and persists across reboots. - After disabling defenses, the malware steals credentials from browsers, wallets and messaging platforms. - organisations should update Windows, check the driver blocklist, remove the malicious service, and rotate credentials.

Terms used in this article - DLL side‑loading, a method where a legitimate executable loads a malicious library that shares its name and location. - SYSTEM account, the most privileged built‑in account on Windows, equivalent to root on Linux. - Kernel driver, software that runs in the core of the operating system with high privileges. - EDR, endpoint detection and response, a class of security tools that monitor endpoint activity. - Driver blocklist, a list maintained by Microsoft of drivers known to be malicious or vulnerable, which Windows blocks from loading.