A recent discovery by researchers at LastPass and Delphos Labs revealed a fake LastPass Authenticator installer being distributed on GitHub. This malicious installer includes a Windows kernel driver that disables antivirus and security software, allowing a password stealer to run undetected on the victim’s system.
The driver used in this attack, named Alinubx.sys, is signed through Microsoft’s hardware-compatibility program and was not detected by antivirus software at the time of discovery. Despite being signed by Microsoft, the driver carried out malicious activities such as terminating security processes and stealing sensitive information from the victim’s system.
The fake installer is hosted on a fake GitHub page that mimics a legitimate LastPass product page, tricking users into downloading and running the malicious software. Once executed, the installer uses DLL side-loading to gain administrator privileges and installs the kernel driver.
After installation, the driver proceeds to disable security software and steal passwords, cryptocurrency wallet files, and login sessions from various applications. It also attempts to collect sensitive information stored in browsers and Windows Credential Manager.
If a user unknowingly runs the fake installer, it is recommended to assume that all saved passwords and sensitive data on the affected machine have been compromised. Users should change their passwords from a secure device and monitor their accounts for any suspicious activity.
Defenders are advised to look for signs of the malicious driver on affected systems, such as specific services, files, signers, and behaviors associated with the attack. Additionally, a community detection for the driver has been published on LOLDrivers for reference.
This incident highlights the importance of remaining vigilant against fake software installers and conducting thorough security checks to prevent such attacks. Users should only download software from official sources and be cautious of any unexpected or suspicious downloads.
