Fake Last Pass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
Summary: A fake LastPass Authenticator installer hosted on a GitHub page installed a Microsoft-signed Windows kernel driver, named Alinubx.sys by researchers, that terminates 145 antivirus and security process names before a password stealer runs, LastPass and Delphos Labs reported on September 17. The driver is a renamed copy of CcProtect.sys from the Chinese disk-encryption product CnCrypt, signed through the Microsoft Windows Hardware Compatibility Publisher chain with a March 2023 signing date, and it was not on Microsoft's vulnerable driver blocklist when Delphos checked on August 20 or at the time of the report.
Bottom line: The rename dropped detections from 7 of about 70 engines to zero, and the blocklist matches file hashes, so a recompiled or renamed driver carries a hash the list does not hold. The driver stays loaded, re-kills security tools, and re-runs the stealer on every reboot, so an infected machine is a kernel-level compromise that the tools meant to clean it up cannot see.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026