Sophisticated Malware Campaign Uses Fake LastPass GitHub Page and Kernel Driver to Disable Antivirus and Steal Sensitive Data
A newly uncovered and highly sophisticated cyberattack campaign is leveraging rogue GitHub repositories disguised as legitimate software distribution pages to deliver a malicious payload capable of blinding enterprise-grade endpoint security solutions. Disclosed jointly by security researchers at password management giant LastPass and threat intelligence firm Delphos Labs, the campaign relies on a deceptive search engine optimization (SEO) strategy to trick unsuspecting users into downloading a credential-stealing trojan. Once executed, the malicious installer employs a specialized Windows kernel driver to systematically terminate popular antivirus and security monitoring processes, paving the way for the unhindered extraction of web browser credentials, cryptocurrency wallets, messaging application sessions, and sensitive operating system files.
While the campaign prominently utilized branding associated with LastPass, representatives from the password management firm confirmed that none of their corporate infrastructure, internal networks, or customer vaults were compromised in the incident. Instead, threat actors merely hijacked the company’s name and visual identity to fabricate a convincing fraudulent product page. Security analysts emphasize that this attack highlights an escalating trend of sophisticated threat groups abusing trusted development platforms and leveraging legitimately signed third-party code to bypass modern Windows security architectures.
Anatomy of the Attack: From Phishing Lure to Kernel-Level Compromise
The multi-stage attack begins when a user searches for utility software—in this case, the LastPass Authenticator—using popular search engines. The malicious operators established a deceptive GitHub repository hosted at github.com/LastPass-Authenticator, meticulously crafted to mimic an official download hub. Through aggressive SEO manipulation, this fake repository consistently achieved high rankings in search engine results for terms related to LastPass utilities, boosting its visibility and credibility to casual observers.
Upon visiting the fraudulent GitHub page and clicking the download link, the victim is redirected through a series of intermediary pages before finally retrieving a heavily padded ZIP archive ranging between 127 MB and 148 MB in file size. Security experts noted that the excessive file size was deliberately achieved by packing the archive with junk data. This tactic is specifically designed to bypass automated security scanners and endpoint detection systems that implement file size limitations, preventing them from thoroughly inspecting the archive’s actual contents.
Inside the extracted archive, victims find a renamed copy of a legitimate Microsoft debugging tool, vsdbg.exe, sitting alongside a malicious dynamic link library (DLL) named vsdbg.dll. When the user unwittingly executes the setup file, Windows inadvertently loads the attacker’s malicious DLL from the local application directory—a classic persistence and execution technique known as DLL side-loading.
Leveraging this execution vector, the loader initiates a series of privilege escalation attempts. It successfully navigates through various system checks to attain the coveted NT AUTHORITYSYSTEM privilege level, which represents the highest tier of access available within a Windows operating system environment. With administrative permissions secured, the malware installs a malicious Windows kernel driver as an active system service, setting the stage for the neutralization of installed security software.
The Threat of BYOVD: How a Legitimate Microsoft Trust Chain Was Abused
At the core of the infection mechanism is a kernel-level driver designated by researchers as Alinubx.sys. Operating at the kernel level—an architecture layer situated below user-mode applications where traditional antivirus, endpoint detection and response (EDR), and anti-malware utilities execute—the driver remains entirely invisible to standard monitoring tools.
Alinubx.sys contains a hardcoded blocklist comprising the process names of 145 distinct antivirus and security applications. Upon initialization, the driver systematically scans the running processes on the machine and instantly terminates any security software matching its internal list. Because this termination command is issued from the kernel, user-mode security solutions are powerless to intercept, block, or log the activity.
This technique is a textbook example of a Bring Your Own Vulnerable Driver (BYOVD) attack. In this scenario, threat actors utilize a legitimate, third-party driver that carries a valid cryptographic signature, allowing it to bypass native operating system checks that demand driver verification. Specifically, the Alinubx.sys driver is a renamed iteration of CcProtect.sys, a component originally associated with a Chinese disk-encryption utility known as CnCrypt. The original driver is already cataloged in public vulnerability repositories such as LOLDrivers due to its inherent process-killing capabilities.
Crucially, the driver was signed through the official Microsoft Windows Hardware Compatibility Publisher trust chain, bearing a digital attestation timestamp from March 2023—years prior to the execution of this specific cyberattack campaign. This detail underscores a critical security reality highlighted by Delphos Labs: Microsoft’s digital attestation pipeline merely verifies that a driver has successfully traversed an administrative review process, but it does not inherently guarantee that the driver’s underlying behavior is benign or safe from malicious abuse.
Comprehensive Data Exfiltration and Payload Capabilities
Once the kernel driver has successfully terminated all active security software and neutralized endpoint protections, a secondary payload—identified by LastPass as the Rapuncel infostealer—initiates its data collection routines. Operating without interference, the stealer systematically harvests a vast array of sensitive information stored on the victimized machine.
The targeted data repositories include:
- Saved login credentials, cookies, and session tokens extracted from more than two dozen distinct web browsers.
- Local configuration files and private keys associated with multiple cryptocurrency wallet applications.
- Active session identifiers for popular communication and gaming platforms, including Discord, Steam, and Telegram.
- Sensitive credentials and keys stored natively within the Windows Credential Manager.
- Local documents carrying descriptive nomenclature such as "password," "seed," "recovery," or "wallet."
To circumvent modern browser security features—such as Google’s app-bound encryption implemented in Chromium-based browsers like Google Chrome and Microsoft Edge to thwart automated credential dumping—the stealer deploys advanced code injection techniques. By injecting payloads directly into the browser processes, the malware compels the browser’s native internal services to decrypt and release stored passwords, which are subsequently packed into a compressed archive and transmitted via command-and-control channels to the attackers’ remote servers.
Security researchers noted that while the deployed driver possessed extensive secondary capabilities—including file cloaking, process injection, and web traffic rerouting—these advanced features remained dormant because the attackers omitted the necessary configuration files from the initial deployment package. Nevertheless, the raw destruction caused by the process-termination routine and subsequent data harvesting was more than sufficient to achieve the threat actors’ primary objectives.
Industry Response and Vendor Accountability
The disclosure of the campaign has reignited discussions within the cybersecurity community regarding the efficacy of operating system security controls, particularly Microsoft’s vulnerable driver blocklist. Introduced to mitigate BYOVD attacks, the blocklist is designed to prevent known malicious or easily abused drivers from loading during the Windows boot cycle.
However, investigations conducted by Delphos Labs revealed that neither the renamed Alinubx.sys driver nor its original iteration, CcProtect.sys, were included in Microsoft’s recommended driver blocklist at the time of the incident. Because the blocklist relies primarily on precise file hash matching, minor modifications such as file renaming or recompilation generate entirely new cryptographic hashes, successfully evading detection rules.
When Delphos researchers formally reported the driver to Microsoft on August 19, company representatives responded that the component’s behavior did not strictly align with their internal definition of a software security vulnerability, as the driver was authored by a third-party vendor rather than Microsoft itself. Microsoft directed the researchers to submit the driver through a separate review channel dedicated to updating the driver blocklist, a submission that was completed immediately thereafter. At the time of the public advisory on September 17, the driver remained unlisted on the default blocklist.
Broader Implications and Attribution Context
Investigators tracking the underlying infrastructure discovered that the LastPass phishing lure was part of a much broader, automated impersonation campaign. Telemetry data indicates that the attacker-controlled servers hosted fraudulent distribution pages targeting more than 40 distinct commercial brands. Furthermore, a secondary repository designed to distribute a macOS variant of the malicious installer was identified and successfully taken down by platform moderators before it could become widely operational.
Threat intelligence analysts assess with high confidence that the malicious loader utilized in this campaign was constructed using the Cruciferra crypter, a commercial utility available on underground markets that conveniently features a default kill list of 145 security processes and modular driver support. With moderate confidence, researchers link the Rapuncel infostealer family to other recent campaigns utilizing GitHub-based SEO poisoning, such as the BoryptGrab and similar malware vectors documented widely throughout early and mid-2026.
Remediation and Recommendations for Affected Users
Due to the deep, kernel-level integration of the malicious driver and the speed at which the infostealer harvests localized data, organizations and individuals who interacted with the fraudulent installation package face severe remediation challenges.
Security experts advise that any workstation compromised by this installer must be treated as completely untrustworthy, suffering from a full kernel-level security breach. Standard antivirus scans or disinfection scripts are fundamentally inadequate, as the malicious driver persists across system reboots, continuously re-terminating security agents and re-deploying data exfiltration routines.
Recommended remediation steps for affected parties include:
- Immediately isolating the compromised machine from all local area networks and corporate intranets.
- Assuming that all browser-stored passwords, cryptocurrency wallets, messaging tokens, and system credentials accessed on the device have been fully compromised.
- Executing password resets, credential rotations, and session revocations from an entirely clean, uncompromised secondary device.
- Conducting a thorough forensic review of account logs and authentication histories for unauthorized activity.
- Performing a complete system wipe and re-image of the affected hardware, or replacing the storage drive entirely to eliminate any possibility of persistent kernel-level rootkits.
Defenders and enterprise security teams are encouraged to monitor network telemetry for anomalous outbound connections associated with untrusted GitHub redirect chains, investigate unauthorized installations of debugging utilities such as vsdbg.exe, and monitor system event logs for unexpected kernel driver installations originating from unverified publishers.
Related posts:
