Fake LastPass Authenticator Installs Signed AV-Killing Driver

BleepingComputer first reported the campaign on September 18, while LastPass and Delphos Labs published the underlying technical analysis a day earlier. Their findings describe a long-running SEO-poisoning operation that used fake GitHub organizations and GitHub Pages download portals to impersonate at least 40 companies. LastPass was one lure, not the breached party: the company says no LastPass system, vault, or customer account was involved, and GitHub is not an official distribution channel for LastPass Authenticator.

The immediate issue for Windows administrators is the driver, identified as Alinubx.sys. The campaign disguises it as nvfsflt64.sys, registers it as the NvFsFilter service, and presents it as an NVIDIA-related component. It is not a fake driver with a forged signature. According to LastPass and Delphos, it was signed through the Microsoft Windows Hardware Compatibility Publisher chain and had not been listed in Microsoft’s vulnerable-driver blocklist when the researchers checked.

A fake installer turns Visual Studio tooling into a loader​

The initial lure starts with a search for LastPass Authenticator or other popular applications. The fraudulent GitHub page uses familiar branding and a prominent download button, then passes the victim through a redirect chain to a ZIP archive hosted on attacker-controlled infrastructure.

Those archives were deliberately oversized—up to 148 MB in the LastPass samples—using junk content to exceed the file-size limits of some automated inspection systems. That detail matters because security gateways and sandboxing products often apply different scanning policies to unusually large archives. A ZIP file’s size therefore should not be read as evidence that it contains a real application installer or a complete offline package.

Inside is a renamed copy of Microsoft’s Visual Studio CoreCLR Debugger, vsdbg.exe, paired with a malicious vsdbg.dll. The attackers rely on DLL side-loading: when the legitimate Microsoft executable starts, Windows loads the attacker-controlled DLL placed beside it. This is a familiar abuse of normal application-loading behavior, but its use here gives the malicious package the appearance of a recognizable development component rather than an obviously hostile executable.

The loader then attempts to gain elevated rights and installs the kernel driver. Delphos Labs assesses with high confidence that the loader was made with, or closely derived from, the Cruciferra PUROSANGUE crypter. That relationship describes the loader and obfuscation method, not a confirmed identity for the people operating the broader campaign.

The signed-driver gap is the critical failure point​

Alinubx.sys is the part of this intrusion that changes the response requirements. LastPass and Delphos found that the driver exposes a process-termination interface and contains 145 hard-coded process names associated with security products. Once the loader identifies a target process, the driver opens it from kernel mode and terminates it.

This allows the operation to work below the user-mode protections on which many endpoint products depend. The researchers say the implementation can defeat Protected Process Light, a Windows mechanism used to make selected security processes resistant to termination even by an administrator. If the driver has loaded, relying on the affected endpoint’s own antivirus console to verify or remediate the incident is unsafe.

Microsoft’s own documentation makes clear that the vulnerable-driver blocklist is a mitigation, not a complete catalogue of every risky third-party kernel component. The blocklist is enabled by default on modern Windows 11 installations, and enforcement is strengthened when Memory Integrity, Smart App Control, or S mode is active. Microsoft also notes that some entries may be held back to avoid breaking legitimate software, and it recommends App Control policies and the Attack Surface Reduction rule for abused vulnerable signed drivers as additional controls.

That is the practical gap exposed here. Windows can enforce a blocklist against drivers Microsoft already knows to block, but the LastPass report says Alinubx.sys was absent from that list at the time of analysis. A Microsoft-attested driver may pass normal trust checks while still providing an attacker with a dangerous process-killing primitive. Attestation establishes provenance within a signing program; it does not certify that every capability of a third-party driver is appropriate for every deployment.

The researchers tied Alinubx.sys to the CnCrypt/CcProtect driver line associated with Henan Dafeng Software. Their analysis says the campaign driver retained CnCrypt product information and a similar process-kill mechanism but changed visible identity fields, including its filename. The original CcProtect.sys family was already known in bring your own vulnerable driver research, where attackers repurpose legitimate signed drivers to gain kernel-level capabilities.

Rapuncel targets passwords, browser sessions, and wallets​

With defenses disabled, Rapuncel begins collecting data. LastPass and Delphos report that the stealer targets saved credentials from at least 25 browsers, Windows Credential Manager, cryptocurrency wallet data, and session information from Discord, Steam, and Telegram. It also looks for documents whose names include terms such as “password,” “seed,” “wallet,” and “recovery,” gathers system information, and captures screenshots from all connected displays.

The browser component is especially relevant in organizations that depend on browser-stored passwords or sessions for cloud administration. The researchers say Rapuncel uses a helper DLL injected into Chrome-, Edge-, and Chromium-related processes, then invokes the browser’s elevation service to work around Google’s app-bound encryption safeguards. In plain terms, browser encryption helps only while the protected browser process remains trustworthy; malware running with high privilege on the endpoint can attempt to use the browser’s own trusted mechanisms against it.

Stolen data is compressed and sent to an external endpoint using traffic formatted as HTTP over raw TCP, according to the LastPass report. Rapuncel also installs a Windows service for persistence. On reboot, it can again attempt to kill restarted security tools before relaunching the stealer.

LastPass and Delphos see overlap with Trend Micro’s March 2026 BoryptGrab reporting, including the use of SEO-optimized GitHub repositories, GitHub Pages portals, similar collection artifacts, and at least one shared lure brand. But they stop short of claiming the same operator or malware family with certainty. Their assessment is that Rapuncel is a BoryptGrab-related variant or sibling build, rather than a confirmed match to Trend Micro’s documented samples. That restraint is warranted: similar delivery infrastructure can show shared tooling or suppliers without proving a single actor.

What to hunt and what to do after execution​

Administrators should search telemetry for the campaign’s behavioral trail rather than depend solely on a domain or hash block. The delivery domains, redirect servers, and payload archives are easily rotated; a driver service, an unusual file path, and a suspicious side-loading relationship are more durable evidence.

• Investigate the creation of the NvFsFilter service and the presence of C:\Windows\System32\drivers\nvfsflt64.sys, especially where the purported NVIDIA driver has no corresponding legitimate software deployment record.
• Hunt for vsdbg.exe executing from download directories, temporary folders, user profile paths, or application-install locations where Visual Studio debugging tooling is not expected.
• Review driver-load, service-installation, and endpoint events for Alinubx.sys, CcProtect.sys, ProtectR3.dll, \\.\Alinubx, and CnCrypt or Henan Dafeng-related product metadata.
• Escalate endpoint detections that show a kernel-driver load immediately followed by the unexpected termination or restart failure of Defender, EDR, or antivirus processes.
• Look for forensic remnants including browser_decryption.log and sends.log in temporary directories, which the researchers identify as potential indicators of the Rapuncel collection process.

A machine that ran the installer should be isolated from the network. Resetting passwords from that same endpoint is counterproductive, since the malware targets browser credentials and active sessions. Change passwords, revoke active sessions and API tokens, rotate cryptocurrency wallet access where applicable, and review identity-provider and password-manager audit logs from a separate known-clean system.

Because the reported driver operates in the kernel and is used to suppress endpoint defenses, a normal in-place scan should not be considered conclusive. LastPass advises Safe Mode or an external recovery environment to remove the driver; in an enterprise setting, preservation of forensic evidence followed by reimaging is often the cleaner response. Devices that handled administrator credentials, password-manager sessions, privileged browser profiles, developer tokens, or financial accounts should be prioritized first.

The campaign’s visible GitHub pages will be removed and recreated. The more enduring concern is that it chained an ordinary user action—clicking a high-ranking download result—to a signed kernel driver that Windows had not yet blocked. For defenders, the actionable lesson is to monitor the driver and service lineage now, before the lure changes names again.