{
  "id": 9148530,
  "title": "Fake LastPass Authenticator Installs a Microsoft-Signed Driver That Kills 145 Security Tools",
  "url": "https://urgent.news/2026/09/22/fake-lastpass-authenticator-installs-a-microsoft-signed-driver-that",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T14:06:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/etairos/fake-lastpass-authenticator-installs-a-microsoft-signed-driver-that-kills-145-security-tools-37mo"
  },
  "original_language": "en",
  "account": "A malicious installer for a fake LastPass Authenticator on GitHub installs a signed Windows kernel driver named Alinubx.sys. The driver terminates 145 antivirus and EDR processes. After running a credential stealer, the threat can access saved passwords, cryptocurrency wallet files, Discord and Steam sessions, and files with specific keywords in their names. This attack impacts user credentials across various platforms, requiring users to rotate their passwords from a separate clean device.",
  "summary": "TL;DR what: A fake LastPass Authenticator installer on GitHub side-loads a malicious DLL, escalates to SYSTEM, and installs a Microsoft-signed kernel driver named Alinubx.sys that terminates 145 antivirus and EDR processes before running a credential stealer. A fake LastPass Authenticator installer distributed through GitHub installs a Microsoft-signed Windows kernel driver that terminates 145…",
  "key_points": [
    "Fake LastPass Authenticator installer installs Alinubx.sys driver",
    "Driver terminates 145 antivirus and EDR processes",
    "Threat accesses passwords, crypto wallets, sessions"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}