Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer, signed by Microsoft, was used to disable antivirus and EDR software, allowing a password stealer to collect data from over two dozen browsers, cryptocurrency wallets, and various online accounts. The installer leveraged a renamed copy of a legitimate Chinese disk-encryption driver (CnCrypt) and a paid crypter (Cruciferra) to bypass security measures. Despite initial detections, the threat remained undetected due to a clever renaming strategy and a lack of inclusion on Microsoft's driver blocklist. The attackers utilized numerous fake GitHub repositories to spread the malware.
A fake LastPass Authenticator installer, signed by Microsoft's Hardware Compatibility Program, was used to disable antivirus and endpoint detection and response (EDR) software, facilitating a password stealer attack. Researchers at LastPass and Delphos Labs discovered this on September 17th. The installer was designed to look like a legitimate LastPass product page hosted on GitHub, mimicking a real LastPass page to trick users into downloading it.
Clicking the download button led to a series of GitHub pages, ultimately directing users to an attacker server. The server served a large ZIP file containing a renamed copy of a legitimate Chinese disk-encryption driver, CcProtect.sys, which is already listed on the LOLDrivers catalog as a process killer. The rename effectively bypassed antivirus detections, as the original driver showed 7 of about 70 engines flagging it in August, while the renamed driver showed zero.
To gain administrator rights, the installer utilized a DLL side-loading technique, loading the attacker's DLL from the same folder. The driver, named Alinubx.sys, carried a list of 145 antivirus and security process names and terminated each one it found running. The attackers also employed a paid crypter, Cruciferra, to further obfuscate the malware.
Despite the driver's presence on the LOLDrivers catalog and the Microsoft's vulnerable driver blocklist, it remained undetected due to the renaming strategy. Microsoft initially responded to Delphos's report stating that the behavior did not meet its definition of a security vulnerability, pointing to a separate channel for driver blocklist considerations.
If you ran the fake installer, treat every password saved in the browser on that machine as stolen, along with any cryptocurrency wallet files, Discord, Steam, and Telegram sessions, and anything in Windows Credential Manager. The stealer copies these out before the driver work begins. The driver stays loaded, re-kills security tools, and re-runs the stealer on every reboot.
The attackers utilized numerous fake GitHub repositories to spread the malware, with LastPass identifying at least 40 brands impersonated by the attacker server. Delphos assesses with moderate confidence that the stealer, which LastPass calls Rapuncel, is a relative of BoryptGrab. The report provides no victim count, and the exact number of infected machines is unknown.
**Defenders should hunt for:**
- Service: a service created as NvFsFilter
- File: a driver written to C:\Windows\System32\drivers\nvfsflt64.sys
- Signer: a driver whose signing details name Henan Dafeng Software or contain "CnCrypt"
- Device: the path \.\Alinubx
- Behavior: a driver load followed by security processes being killed