Fake LastPass Authenticator GitHub Repository Deployed to Facilitate Kernel-Level Malware Attacks
In a sophisticated cybersecurity campaign that underscores the growing danger of "Bring Your Own Vulnerable Driver" (BYOVD) attacks, researchers from LastPass and Delphos Labs have uncovered a malicious operation leveraging a fraudulent GitHub repository to distribute a high-level credential stealer. The campaign, which came to light on September 17, relies on a deceptively authentic-looking page posing as the official LastPass Authenticator download portal. By masquerading as a legitimate security tool, the attackers successfully bypassed traditional endpoint protection mechanisms, allowing them to gain administrative control over victims’ Windows systems and exfiltrate sensitive data.
The incident highlights a critical vulnerability in modern supply chain and software distribution security. While LastPass itself remains uncompromised—with the company confirming that its internal infrastructure and customer vaults were not touched—the use of its brand identity to trick users into installing a malicious payload represents a significant evolution in social engineering tactics.
The Anatomy of the Attack: From GitHub to Kernel-Level Compromise
The operation begins with search engine optimization (SEO) poisoning. By creating a professional-looking GitHub repository at github.com/LastPass-Authenticator, the threat actors ensured their site appeared prominently in search results for queries such as "LastPass Authenticator download." To an unsuspecting user, the site appeared indistinguishable from a legitimate product page.
Once a visitor clicks the download link, the site initiates a multi-stage redirection process, eventually directing the user to an external server. This server delivers a heavily padded ZIP file, ranging between 127 MB and 148 MB in size. The intentional padding serves a strategic purpose: many antivirus scanners and automated malware analysis tools possess file-size limits and will skip scanning archives that exceed these thresholds, effectively allowing the malicious payload to bypass initial detection.
Inside the ZIP archive, the attackers employ a classic technique known as DLL side-loading. They package a renamed, legitimate Microsoft debugging tool, vsdbg.exe, alongside a malicious library file, vsdbg.dll. When the user executes the installer, Windows naturally loads the attacker’s DLL from the same directory as the debugger. The loader then systematically escalates privileges, eventually securing SYSTEM-level access—the highest level of authority on a Windows machine.
Once the malicious code reaches this level of authority, it installs a kernel driver named Alinubx.sys. This driver operates at a level deeper than traditional security software, allowing it to systematically terminate 145 different antivirus and Endpoint Detection and Response (EDR) processes. By disabling these security barriers from the kernel, the malware creates a "safe zone" for the primary payload, identified by researchers as the Rapuncel infostealer.
The Role of Signed Drivers and Trust Pipelines
A particularly alarming aspect of this attack is that the Alinubx.sys driver is digitally signed through the Microsoft Windows Hardware Compatibility Publisher program. This certification, dated March 2023, provides the malware with an air of legitimacy that allows it to pass through operating system security checks that would otherwise flag unsigned or suspicious drivers.
The researchers note that the driver is essentially a rebadged version of CcProtect.sys, a Chinese disk-encryption driver known to be vulnerable. By simply renaming the driver and changing its description, the attackers successfully obfuscated its identity. While the original driver was known to cybersecurity researchers and documented on the LOLDrivers catalog—a repository of legitimate but abusable drivers—the altered version triggered zero detections on VirusTotal as of August.
This event serves as a stark reminder that Microsoft’s attestation process is not a guarantee of security. As the researchers pointed out, "Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe." The trust inherent in the Windows Hardware Compatibility Publisher chain creates a blind spot that threat actors are increasingly exploiting to deliver kernel-level rootkits and stealers.
Timeline of Discovery and Mitigation Efforts
The discovery process began in mid-August when security analysts identified the fraudulent activity. The timeline of the event illustrates the challenges of incident response when dealing with signed but malicious drivers:
- August 19: Delphos Labs researchers formally notified Microsoft of the malicious driver and its behavior.
- August 20: Researchers confirmed that the driver was not included in Microsoft’s official vulnerable driver blocklist.
- Late August: Independent analysis of the malicious repository revealed a broader campaign involving at least 40 different brands being impersonated by the same attacker infrastructure.
- September 17: LastPass and Delphos Labs publicly disclosed the threat, providing technical details and urging users to verify download sources.
Despite the report, the driver remained absent from the official Windows blocklist as of mid-September. Microsoft’s response to the researchers indicated that the behavior did not meet its strict criteria for a "security vulnerability," as the driver itself is not a Microsoft component. This highlights a recurring friction point in cybersecurity: the gap between third-party security researchers reporting abuse and the procedural hurdles involved in updating global OS-level blocklists.
Impact and Data Exfiltration
The consequences for an infected machine are severe. Once the security software is neutralized, the Rapuncel infostealer acts with impunity. It systematically scrapes browser data from over two dozen applications, including saved passwords, cookies, and session tokens. Furthermore, it targets cryptocurrency wallets, Discord, Steam, and Telegram accounts, and performs a deep scan of the Windows Credential Manager.
For modern browsers like Chrome and Edge, which utilize app-bound encryption to protect stored credentials, the stealer uses a sophisticated method of code injection. By forcing the browser’s own internal service to perform the decryption, the malware successfully bypasses the encryption layers intended to protect user data from unauthorized access. The stolen data is then compressed into a ZIP archive and transmitted to the attacker’s command-and-control server.
Broader Implications for Cybersecurity
The LastPass/Delphos Labs report is part of a growing trend of "malware-as-a-service" and the commoditization of BYOVD techniques. The use of the Cruciferra crypter to build the loader suggests that the attackers are professional operators, utilizing paid tools to ensure their malware remains elusive.
The prevalence of fake GitHub repositories as a distribution vector is particularly concerning. GitHub, as a platform, has become a primary target for threat actors looking to leverage the trust developers and IT professionals place in open-source repositories. In March, Trend Micro documented the BoryptGrab stealer, and in July, Arctic Wolf reported on a wave of nearly 300 repositories hosting similar malware. This incident confirms that these campaigns are not isolated anomalies but part of a persistent, scalable strategy to compromise high-value targets.
Recommendations for Defenders and Users
For individuals who may have inadvertently run the fake installer, the situation requires a comprehensive response. Because the malware operates at the kernel level, standard antivirus scans are likely to be ineffective, as the malware has already disabled the engines that would perform the scan.
Security professionals recommend the following steps:
- Treat as Total Compromise: A machine infected by this driver should be considered fully compromised. A clean reinstall of the operating system is the only way to ensure the kernel-level persistence is eradicated.
- Credential Hygiene: Users must assume that all credentials, including those stored in browsers, were exfiltrated. Password resets should be performed immediately, ideally from a separate, clean, and uncompromised device.
- Monitor for Anomalies: Organizations should hunt for the presence of the driver by looking for behavior-based indicators—specifically, processes attempting to terminate security software—rather than relying solely on file hashes, which are easily changed by the attackers.
- Verification of Sources: The industry must reinforce the necessity of downloading software exclusively from official, verified domains (e.g., lastpass.com) rather than third-party code repositories or search engine advertisements, which are increasingly manipulated by malicious actors.
As threat actors continue to leverage the "trust" architecture of Windows against itself, the burden of vigilance shifts further onto the user and the enterprise security team. The incident serves as a critical call to action for platform providers like Microsoft and Google to implement more robust verification systems that go beyond simple digital signing, ensuring that the software distribution ecosystem is not a gateway for the next generation of kernel-level threats.
Related posts:
