Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
Attackers have been using a fake LastPass Authenticator app to disable antivirus software and put users at risk. The scam involves SEO poisoned GitHub pages that redirect users to a malicious ZIP file. Inside the ZIP are files like vsdbg.exe, which acts as a legitimate Microsoft debugging tool and a malicious DLL called vsdbg.dll.
When run, the DLL sideloads the malware, which gains administrative access, installs a kernel driver disguised as an NVIDIA graphics component, and terminates 145 antivirus programs. The malware then steals passwords and tokens from various applications like browsers, wallets, Discord, Steam, Telegram, Windows credentials, and more.
It also intercepts web traffic, stealing data and injecting ads. The malware can persist on the infected system, staying hidden until the kernel driver is physically removed. LastPass and security researchers Delphos discovered this scheme and warn users to only download apps from trusted sources.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
