Sophisticated Malware Campaign Uses Fake LastPass GitHub Page and Kernel Driver to Disabling Security Software and Steal Data

A sophisticated and highly targeted cyberattack campaign has emerged, leveraging fraudulent GitHub repositories and a legitimate, Microsoft-signed Windows kernel driver to systematically disable endpoint protection before deploying a potent password-stealing payload. Disclosed jointly by security researchers at LastPass and threat intelligence firm Delphos Labs, the malicious operation highlights an increasingly popular and dangerous technique utilized by modern threat actors: the weaponization of valid software components to bypass system defenses. By masquerading as an official LastPass Authenticator installer on search engines, the malicious actors successfully tricked users into deploying a multi-stage intrusion chain that effectively blinds standard antivirus and endpoint detection and response (EDR) software.

The Anatomy of the Attack Campaign

The attack vector relies heavily on search engine optimization (SEO) poisoning. The threat actors established a deceptive GitHub page mimicking an official LastPass product portal, strategically named to rank prominently when users searched for terms such as "LastPass Authenticator download." For unsuspecting users seeking legitimate authentication tools, the page appeared completely authentic, utilizing proper branding and mimicking standard developer release formats.

When a visitor initiated a download from the fraudulent repository, the interaction bypassed normal distribution pipelines. Instead of retrieving the application from official domains—such as lastpass.com or authorized mobile app stores—the download redirected the user through a sequence of intermediate GitHub pages before finally serving a bulky ZIP archive. Ranging between approximately 128 MB and 148 MB, these archives were heavily padded with junk data. Security analysts noted that this padding was an intentional evasion tactic designed to bypass file-size scanning limits imposed by certain automated security inspection tools and email gateways.

Inside the compressed archive lay a calculated arrangement of files: a renamed copy of a legitimate Microsoft debugging utility named vsdbg.exe, accompanied by a malicious dynamic-link library file labeled vsdbg.dll. Upon execution, the Windows operating system loaded the attacker’s DLL from the application directory—a classic persistence and execution mechanism known as DLL side-loading. Leveraging this foothold, the loader systematically escalated privileges, executing a series of escalation attempts until it achieved SYSTEM-level access, the highest privilege tier available within the Windows environment. Once absolute control was secured, the malware proceeded to install a malicious Windows kernel driver as a system service.

The Mechanics of the BYOVD Technique and Security Neutralization

The core danger of the campaign lies in the deployment of the kernel driver, identified by researchers as Alinubx.sys. Operating at the kernel level, this driver functions well beneath the user-mode threshold where conventional antivirus and EDR solutions operate. Consequently, the security software is rendered blind and powerless to intercept the driver’s actions.

This methodology is a textbook implementation of the "Bring Your Own Vulnerable Driver" (BYOVD) technique. The driver utilized in this campaign is a renamed iteration of CcProtect.sys, a component originally associated with a Chinese disk-encryption utility known as CnCrypt. While the original driver was already documented within open-source threat databases like LOLDrivers as a process-termination tool with public proof-of-concept exploits, the attackers executed a simple yet effective modification: they changed the file name and description while retaining the underlying product version and submitter signatures.

This minor alteration drastically impacted threat detection visibility. While the original driver triggered flags in roughly 10 out of 70 security engines on aggregate analysis platforms like VirusTotal, the renamed variant scored zero detections upon initial discovery. Furthermore, the driver carried a valid digital signature issued through the Microsoft Windows Hardware Compatibility Publisher chain, dated March 2023. Because the binary passed through Microsoft’s official attestation pipeline years prior to the campaign, the operating system inherently trusted it, permitting the driver to load without triggering default security blocks.

Equipped with kernel-level privileges, the Alinubx.sys driver executed its primary operational directive: terminating security defenses. The driver contained a hardcoded blocklist comprising 145 distinct process names associated with prominent antivirus suites, firewalls, and EDR agents. As it initialized, the driver systematically scanned active system processes and forcibly terminated every security application encountered on its target list.

Deployment of the Rapuncel Infostealer and Data Exfiltration

With all defensive monitoring neutralized, the intrusion progressed to its final phase: aggressive data harvesting. The deployed infostealer—referred to by LastPass researchers as Rapuncel—commenced a comprehensive sweep of the compromised host.

The payload targeted a vast array of sensitive user data, focusing heavily on credentials, session tokens, and financial assets. The stealer extracted saved passwords, autofill data, and cookies from more than two dozen distinct web browsers. Notably, for modern browsers such as Google Chrome and Microsoft Edge that employ robust cryptographic protections like app-bound encryption to thwart credential extraction, the malware utilized advanced evasion tactics. It injected code directly into the browser processes, subverting the browser’s own internal services to decrypt and surrender stored credentials.

Beyond browser data, the infostealer swept local directories for cryptocurrency wallet files, active session tokens for popular communication and gaming platforms including Discord, Steam, and Telegram, and the contents of the Windows Credential Manager. It also performed targeted searches for documents matching specific nomenclature, sweeping files containing terms such as "password," "recovery," or "seed." Once harvested, the comprehensive trove of stolen information was compressed into an archive and covertly exfiltrated to command-and-control infrastructure operated by the threat actors.

Industry Response, Microsoft’s Stance, and Broader Implications

The discovery of the campaign prompted rapid analysis and coordinated reporting among cybersecurity entities. Delphos Labs formally reported the malicious use of the signed driver to Microsoft on August 19, requesting its immediate inclusion on the official Microsoft Vulnerable Driver Blocklist.

Microsoft’s initial response underscored the complexities of modern driver attestation and kernel-level security governance. The tech giant stated that the behavior exhibited by the driver did not strictly meet its internal definition of a security vulnerability, noting that the component was not authored by Microsoft itself. Instead, Microsoft directed the researchers to submit the driver through the separate evaluation channel dedicated to updating the recommended driver blocklist.

Security analysts have pointed out critical limitations in current operating system defenses regarding signed binaries. Attestation guarantees only that a driver successfully navigated a signing pipeline at a specific point in time; it provides no continuous assurance regarding the ethical intent or future deployment context of the software. Furthermore, because Windows blocklists rely predominantly on specific file hashes, attackers can easily evade static blacklists simply by recompiling or renaming legitimate, abusable drivers—a reality demonstrated by the fact that Alinubx.sys remained absent from the default blocklist weeks after public disclosure.

Attribution and Historical Context of SEO Poisoning Campaigns

Investigations into the broader infrastructure revealed that the fraudulent GitHub repository targeting LastPass users was part of a much larger, industrialized operation. According to telemetry gathered by LastPass, the primary attacker server hosted impersonation pages designed to mimic no fewer than 40 distinct software brands and technology corporations. A secondary, nearly identical repository targeting macOS users was identified and successfully neutralized before it could be actively deployed.

The tactics observed in this incident align with a broader surge in malicious SEO poisoning and software supply-chain manipulation throughout 2026. Security researchers have repeatedly documented campaigns utilizing compromised or fraudulent GitHub repositories to distribute information stealers. In March, similar methodologies were tied to the BoryptGrab stealer, while subsequent waves reported by threat intelligence agencies in July highlighted hundreds of unauthorized repositories distributing spyware disguised as gaming cheats and productivity utilities.

Security analysts attribute the loader mechanism with high confidence to the Cruciferra crypter—a commercialized, paid utility favored by cybercriminal syndicates—noting its identical hardcoded kill list of 145 security processes and interchangeable driver architecture. Conversely, attribution for the Rapuncel infostealer remains moderately aligned with variants of the BoryptGrab family, though exact victim counts and total financial losses resulting from the campaign remain undetermined due to the swift and quiet nature of the automated exfiltration process.

Remediation and Guidance for Compromised Systems

Organizations and individuals who inadvertently downloaded and executed the fraudulent installer face a severe compromise scenario. Because the infostealer extracts sensitive credentials and session tokens prior to the initiation of the kernel driver, security experts emphasize that all data handled by the affected machine must be treated as fully compromised.

Remediation steps extend far beyond standard antivirus scans. Because the malicious kernel driver automatically reinstalls itself, re-terminates security tooling, and triggers repeated data exfiltration attempts upon every system reboot, conventional user-mode cleanup procedures are fundamentally ineffective.

Cybersecurity professionals strongly advise that any machine known to have executed the payload must be isolated immediately from corporate and personal networks. Affected users are urged to execute password resets, session revocations, and credential revocations exclusively from a separate, uncompromised device. Due to the deep-seated nature of kernel-level compromises, the definitive remediation protocol requires performing a thorough forensic audit followed by a complete wipe and operating system reinstallation from trusted media.

As threat actors continue to weaponize legitimate administrative tools, signed certificates, and trusted developer platforms, the incident serves as a stark reminder of the evolving challenges facing endpoint security architects and everyday digital consumers alike.