Fake LastPass repos ship a signed antivirus killer

A malware campaign is impersonating LastPass to hand out a signed driver that switches off antivirus software, and the driver is one Microsoft has not blocked. LastPass and the security firm Delphos Labs traced the operation, which uses search-optimised GitHub repositories dressed up as the download pages of the password manager and at least 39 other companies. Clicking through leads to a chain of redirects and a ZIP file inflated to as much as 148 megabytes, a size chosen to slip past scanners that refuse to open large archives.

The installer is a renamed Microsoft debugger

Inside the archive sits a copy of vsdbg.exe, Microsoft's legitimate Visual Studio CoreCLR Debugger, renamed and rebuilt to sideload a malicious vsdbg.dll. That fake debugger drops two payloads. The first is Rapuncel, an information stealer the researchers had not documented before. The second is Alinubx.sys, a kernel driver disguised as an NVIDIA component called nvfsflt64.sys, which registers itself as the NvFsFilter service.

A driver that opens processes as the kernel

Alinubx.sys carries a hardcoded list of 145 antivirus and endpoint detection and response processes and works through them one by one. LastPass says the driver calls ObOpenObjectByPointer with AccessMode=KernelMode, which skips the user-mode check that normally runs when a handle is opened, so the driver asks the kernel to open a security product as kernel code and then kills it. That is how it gets past Protected Process Light, the mechanism most endpoint tools rely on to survive an administrator. The driver is signed through Microsoft's Windows Hardware Compatibility Publisher chain and does not appear on Microsoft's recommended driver blocklist. The researchers also found unused capabilities in the driver for hiding files and registry keys, injecting DLLs, intercepting drivers and processes, manipulating traffic and redirecting ports.

What Rapuncel takes once the coast is clear

With endpoint protection disabled, Rapuncel empties the machine. It lifts saved credentials from 25 browsers and data from 30 cryptocurrency wallets, takes Discord, Steam and Telegram session tokens, reads Windows Credential Manager, screenshots every connected monitor and reports detailed system information. It also sweeps for documents whose filenames contain words such as password, seed, wallet or recovery, which largely means the files people keep their recovery phrases in. To get around Google's app-bound encryption on Chrome, Edge and related browsers it injects into the browser process instead of reading the credential store directly.

Our opinion

The interesting failure here is not the malware, it is the trust chain. A driver that kills endpoint security is not subtle, and it still arrived carrying a Microsoft signature, which means the certificate that exists to prove software is trustworthy did exactly what it was told and vouched for the attacker's file. Every protection in the story then falls in sequence behind that: the browser hardening is bypassed by injecting into the browser rather than reading its vault, and the endpoint agent is removed by the kernel before it can object. The detail worth remembering is the 148-megabyte archive. That is not engineering elegance, it is a bet that the defenders will not pay the cost of inspecting anything large, and on this showing the bet paid. Anyone who searched for an authenticator app and clicked the first promising GitHub result has been relying on a search ranking the attackers understood better than the people who wrote it.