Dangerous LastPass Authenticator Impersonation Campaign Deploys Kernel-Level Malware to Bypass Security Defenses

A sophisticated malware campaign masquerading as a legitimate LastPass Authenticator installer has been identified by researchers from LastPass and Delphos Labs, revealing a critical security vulnerability that exploits the trust Windows places in signed hardware drivers. The malicious campaign, which surfaced in late summer 2024, utilizes a deceptive GitHub repository to lure unsuspecting users into downloading a file that, once executed, installs a kernel-level driver capable of systematically disabling antivirus and endpoint detection and response (EDR) software. This high-level compromise allows an information-stealing payload—dubbed "Rapuncel"—to harvest sensitive data, including browser-stored credentials, cryptocurrency wallets, and session tokens for platforms such as Discord, Steam, and Telegram.

The Anatomy of the Deception

The attackers behind this operation demonstrated a high degree of technical proficiency in both search engine optimization (SEO) and malware delivery. By creating a fraudulent GitHub repository titled "LastPass-Authenticator," the threat actors effectively manipulated search engine rankings. When users searched for "LastPass Authenticator download," the malicious site often appeared as a top result, mimicking the professional aesthetic of an official product page.

The delivery mechanism is a classic example of social engineering combined with advanced evasion techniques. Upon clicking the download button on the fake GitHub page, users are redirected through a series of intermediary pages before being served a large ZIP archive. These archives, typically ranging between 127 MB and 148 MB, are intentionally padded with "junk" files to ensure they bypass the file-size scanning limits imposed by many automated security gateways and email filters.

Once the archive is extracted, the victim is presented with a folder containing two critical files: a renamed copy of the legitimate Microsoft debugging tool vsdbg.exe and a malicious file named vsdbg.dll. The infection relies on a technique known as "DLL side-loading." When the user runs the executable, the Windows operating system inadvertently loads the malicious DLL from the same directory, granting the attacker the ability to escalate privileges to the SYSTEM level—the highest possible authority on a Windows machine.

The Role of the Kernel Driver

The most alarming aspect of this campaign is the deployment of a kernel driver, identified by researchers as Alinubx.sys. Because a kernel driver operates at a level deeper than traditional security software, it is uniquely positioned to neutralize defensive measures. Upon execution, the driver references a pre-configured list of 145 known security processes and antivirus programs, forcibly terminating any that are found running on the host system.

The driver itself is a rebadged version of CcProtect.sys, a component of the Chinese disk-encryption software CnCrypt. While the original driver was already documented in the LOLDrivers catalog—a database tracking legitimate drivers that can be abused for malicious purposes—the threat actors successfully evaded detection by renaming the file and altering its metadata. By submitting this altered driver through the Microsoft Windows Hardware Compatibility Publisher chain, the attackers obtained a legitimate signature. This signature provides a false sense of security, as Microsoft’s attestation process confirms that a driver passed through a validation pipeline, but it does not perform a functional analysis to determine if the driver’s behavior is inherently malicious.

Chronology of the Threat

The emergence of this threat highlights a persistent issue in software supply chain security. According to investigations by Delphos Labs, the driver was signed in March 2023, suggesting that the campaign may have been in development or preparation for a significant duration before being deployed in the wild.

• August 19, 2024: Researchers at Delphos Labs identified the malicious driver and officially reported it to Microsoft, identifying its potential for abuse and its capability to disable security products.
• August 20, 2024: Internal assessments by Delphos confirmed that the driver was not present on Microsoft’s official vulnerable driver blocklist, nor were there any detection flags on platforms like VirusTotal at the time of the investigation.
• September 17, 2024: LastPass and Delphos Labs jointly disclosed the findings to the public, confirming that while the attackers leveraged the LastPass brand, no internal LastPass systems, services, or customer vaults were compromised during the incident.

The "Bring Your Own Vulnerable Driver" (BYOVD) Paradigm

This incident underscores the growing prevalence of "Bring Your Own Vulnerable Driver" (BYOVD) attacks. By leveraging legitimate, signed drivers, attackers can bypass modern security features like Kernel Mode Code Signing (KMCS), which typically prevents unsigned code from executing in the Windows kernel. Because the driver is signed by a trusted publisher, the operating system permits its installation and execution, essentially granting the malware the "keys to the kingdom."

The fact that the driver is not currently on Microsoft’s blocklist is a significant point of concern for security professionals. Microsoft’s blocklist, which is active by default in Windows 11, relies on known file hashes. Because attackers can easily recompile or modify these drivers to generate new hashes, the blocklist often lags behind the threat landscape. Microsoft has maintained that the driver does not strictly meet its definition of a security vulnerability, as the component itself is third-party software, placing the onus on third-party security vendors and system administrators to manage driver-level policies.

Implications for Data Security

Once the defensive wall of the EDR and antivirus software is dismantled, the Rapuncel stealer acts with relative impunity. It systematically scans the infected machine for sensitive information. A primary target is the browser-stored credential database. Modern browsers like Google Chrome and Microsoft Edge utilize app-bound encryption to protect saved passwords; however, the Rapuncel stealer circumvents this by injecting code directly into the browser process, requesting that the browser’s own authenticated services perform the decryption.

In addition to browser credentials, the malware targets:

• Cryptocurrency Wallets: Locating and exfiltrating wallet files that grant access to digital assets.
• Session Tokens: Hijacking login sessions for applications such as Discord, Telegram, and Steam, allowing attackers to bypass multi-factor authentication (MFA) and assume the identity of the user.
• Credential Manager: Scraping sensitive data stored within the Windows Credential Manager.
• Targeted File Search: Searching specifically for files with keywords like "password," "seed," or "recovery" to capture private keys and recovery phrases.

Remediation and Best Practices

The severity of this compromise cannot be overstated. Because the malware operates at the kernel level and re-infects the system upon every reboot, standard removal tools are often ineffective. Researchers strongly advise that any machine confirmed to have run the fake installer be treated as fully compromised.

For victims, the remediation steps are stringent:

1. Isolate the Device: Immediately disconnect the affected machine from the internet to prevent further exfiltration of data.
2. Assume Total Compromise: Treat all credentials stored on the machine as exposed.
3. Perform Remediation from a Clean Device: Use a separate, uncompromised computer to change all passwords, particularly for primary accounts (email, banking, and cloud storage) and to reset 2FA seeds where applicable.
4. Forensic Rebuild: Due to the kernel-level persistence of the driver, the most secure course of action is to perform a full wipe and reinstallation of the operating system.

Broader Landscape and Industry Response

This campaign is not an isolated event. It is part of a larger, ongoing trend of attackers using GitHub as a distribution platform for malware. Reports from organizations like Trend Micro and Arctic Wolf have previously identified hundreds of repositories disguised as legitimate software, ranging from game cheats to productivity tools, all designed to deliver similar information-stealing payloads.

The use of the Cruciferra crypter—a modular tool often sold on underground forums—further suggests that the attackers are using professional-grade "Malware-as-a-Service" (MaaS) infrastructure. As threat actors continue to innovate in their use of signed drivers and SEO manipulation, the responsibility falls on both software providers and end-users to remain vigilant. Defenders are encouraged to monitor for unusual kernel-mode activity and to employ strict application control policies that limit the installation of drivers to those explicitly approved by organizational IT departments.

As the industry grapples with the limitations of driver-signing trust models, this incident serves as a stark reminder that digital trust is not synonymous with digital safety. Users are urged to download software exclusively from official, verified domains and to exercise extreme caution when navigating search results that promote "download" links for popular software, particularly when hosted on public code repositories.