A fraudulent LastPass Authenticator installer, available on GitHub, has been discovered to contain a Windows kernel driver that disables antivirus programs before initiating a password theft operation. This was reported by cybersecurity experts from LastPass and Delphos Labs on September 17.
How the Fake Installer Operates
The malicious software is disguised as a legitimate LastPass Authenticator download page on GitHub, which appears in search results for related queries. Upon clicking the download link, users are redirected through several GitHub pages to an attacker’s server, where a large ZIP file is served. This ZIP file includes a renamed Microsoft debugging tool, vsdbg.exe, and a malicious DLL file, vsdbg.dll. The installer employs a technique known as DLL side-loading to execute the attacker’s code, which seeks to obtain administrator privileges and install the kernel driver as a service.
The archives discovered varied in size, padded with extraneous files to evade detection by security scanners with file size limitations.
The Role of the Signed Driver
The driver, named Alinubx.sys by researchers, operates at the kernel level, beneath the reach of standard antivirus and endpoint detection and response (EDR) tools. It contains a list of 145 antivirus and security processes to terminate. This method, known as bring your own vulnerable driver (BYOVD), exploits a legitimately signed driver to gain elevated access.
The driver was signed via Microsoft’s Hardware Compatibility Publisher with a date of March 2023, long before this campaign began. Microsoft attestation only confirms that a driver passed through a trust process, not its safety. The attack’s effectiveness is enhanced because the driver, a modified version of CcProtect.sys, is not included in Microsoft’s vulnerable driver blocklist.
Implications for Affected Users
Users who executed the fake installer should consider all browser-saved passwords, cryptocurrency wallets, and login sessions as compromised. The stealer extracts and transmits data before disabling security software, making recovery challenging. It is advised to change passwords from a clean device and monitor account activity for unauthorized access.
The presence of this driver necessitates a thorough forensic examination or a complete system rebuild to ensure the machine’s security.
Detecting and Preventing Future Attacks
Security professionals are urged to focus on the driver’s behavior rather than static attributes, as attackers can alter file names. Indicators include the creation of a service as NvFsFilter, a driver file named nvfsflt64.sys, and signing details that reference Henan Dafeng Software. Community detection resources, such as LOLDrivers, offer identification methods, although these are susceptible to evasion through file modification.
The GitHub page impersonating LastPass was one of many used by attackers. According to LastPass, the server hosted pages mimicking at least 40 brands. Similar attacks have been documented, underscoring the need for vigilance and improved detection mechanisms.
