A counterfeit LastPass Authenticator installer hosted on GitHub installs a Microsoft-signed Windows kernel driver that silently terminates antivirus and endpoint detection and response (EDR) processes before a password-stealing payload runs, researchers at LastPass and Delphos Labs reported on 17 September 2026. The Hacker News and SecurityWeek amplified the findings this week. LastPass stressed that none of its own systems, services or customer vaults were breached—attackers only borrowed the brand. The campaign is a textbook blend of search-engine optimisation, DLL side-loading, and bring your own vulnerable driver (BYOVD) tradecraft.
Victims searching for terms such as "LastPass Authenticator download" can land on a fake GitHub organisation (`github.com/LastPass-Authenticator`) that mimics a real product page. The genuine LastPass Authenticator is distributed only from lastpass.com and official app stores. Clicking download on the impostor page walks the user through several GitHub screens to an attacker-controlled server that serves a padded ZIP archive—148 MB or 127.9 MB in observed samples—stuffed with junk files so size-capped scanners skip analysis.
From side-load to SYSTEM
Inside the archive sits a renamed copy of Microsoft's legitimate debugging tool `vsdbg.exe` beside a malicious `vsdbg.dll`. When the fake installer runs, Windows loads the attacker's DLL from the same folder. The loader then attempts multiple privilege-elevation paths, reaches SYSTEM, and installs a kernel driver as a service. Researchers named the driver Alinubx.sys. It carries a kill list of 145 antivirus and security process names and terminates each one from kernel mode—below the level where user-mode security products can defend themselves.
The driver is a renamed copy of CcProtect.sys from the Chinese disk-encryption product CnCrypt, already catalogued on LOLDrivers as a process killer with public proof-of-concept code. Renaming dropped VirusTotal detections from seven engines on the known original to zero on the new file when checked in August. Critically, neither the original nor the renamed driver appeared on Microsoft's vulnerable-driver blocklist when Delphos checked on 20 August 2026. The researchers noted that attestation through the Windows Hardware Compatibility Publisher chain proves a driver passed a trust pipeline—not that it is safe. Signing dated to March 2023, years before this campaign.
With EDR blind, the stealer—tracked by LastPass as Rapuncel and assessed with moderate confidence as related to the BoryptGrab family—harvests passwords from more than two dozen browsers, cryptocurrency wallet files, Discord, Steam and Telegram sessions, Windows Credential Manager contents, and files whose names suggest passwords, seeds or recovery material. For Chrome and Edge, which use Google's app-bound encryption, the stealer injects into the browser and asks the browser's own service to decrypt credentials. Stolen data is packaged into a ZIP and exfiltrated to attacker infrastructure. Delphos assesses with high confidence that the loader was built with the commercial Cruciferra crypter.
Persistence and brand abuse at scale
The driver remains loaded across reboots, re-killing security tools and re-launching the stealer—defeating the very products that would normally clean the host. LastPass said the attacker server impersonated at least 40 brands; a near-identical fake "macOS LastPass" page was taken down before full analysis. Fake GitHub repositories delivering stealers are not new: Trend Micro documented BoryptGrab via this pattern in March, and Arctic Wolf reported nearly 300 similar repositories in July.
Microsoft told Delphos that the driver's behaviour did not meet its definition of a vulnerability in a Microsoft component and pointed researchers to the blocklist nomination channel. As of the 17 September report, Alinubx.sys was still not listed. Defenders are urged to hunt by lineage and behaviour, not a single filename.
What victims and defenders should do now
- If you ran the fake installer: treat every browser-saved password, crypto wallet, Discord/Steam/Telegram session and Credential Manager secret on that PC as stolen. Reset credentials from a clean device; rebuild the machine after kernel-level forensic review where possible.
- Download authenticators only from vendor sites and official stores—never from GitHub search results for commercial MFA apps.
- Hunt for: service `NvFsFilter`; driver `C:\Windows\System32\drivers\nvfsflt64.sys`; signer strings "Henan Dafeng Software" or "CnCrypt"; device path `\\.\Alinubx`; driver load followed by mass termination of security processes.
- Enforce Microsoft's vulnerable driver blocklist and monitor for new BYOVD hashes; renamed killers bypass hash-based lists.
- Enterprise: block the fake GitHub organisation and related download domains at the proxy; alert on large ZIP downloads paired with `vsdbg.exe` side-load patterns.
Evidence status
- Confirmed: Joint LastPass/Delphos report documents the fake GitHub lure, BYOVD kill driver, Rapuncel stealer behaviour and persistence; LastPass confirms no breach of its own infrastructure.
- Reported: The Hacker News and SecurityWeek coverage; prior Trend Micro and Arctic Wolf research on related GitHub stealer campaigns.
- Unconfirmed: Exact victim counts and whether every impersonated brand used the identical Rapuncel build.
In brief
- Fake LastPass Authenticator installers on GitHub deploy a Microsoft-signed kernel driver that kills 145 security products, then run the Rapuncel stealer.
- Renaming a known CnCrypt process-killer driver zeroed antivirus detections and slipped past the vulnerable-driver blocklist.
- Anyone who ran the installer should reset credentials from a clean device and rebuild the compromised PC; defenders should hunt BYOVD behaviour, not one hash.