Fake LastPass Authenticator on GitHub Uses Signed Driver to Disable Security Software

Researchers at LastPass and Delphos Labs have identified a malicious campaign using a fake LastPass Authenticator installer hosted on a lookalike GitHub page. The page is designed to appear in search results for terms like "LastPass Authenticator download" and mimics an official LastPass product page. LastPass has confirmed that its own systems, services, and customer vaults were not affected; attackers simply misused its brand name.

Victims who download and run the fake installer trigger a chain of events. A renamed copy of a legitimate Microsoft debugging tool loads a malicious file sitting in the same folder, a technique known as DLL side-loading. This gives the attacker a path to administrator and then SYSTEM level access, allowing them to install a kernel driver as a Windows service. That driver, which operates below the level where antivirus and EDR software run, carries a list of 145 security process names and shuts each one down before a password stealer executes. The driver itself is signed through Microsoft's Windows Hardware Compatibility Publisher program and had zero detections on VirusTotal when researchers checked in August, despite being signed as far back as March 2023.

This approach, known as bring your own vulnerable driver (BYOVD), exploits the trust placed in Microsoft-signed drivers rather than any flaw in LastPass itself. As researchers noted, Microsoft's attestation confirms a driver passed through a trust pipeline, not that the driver is safe to run.