Researchers at LastPass and Delphos Labs identified a malicious LastPass Authenticator installer distributed via a fake GitHub repository that ranks high in search results. The attacker created a counterfeit page at github.com/LastPass-Authenticator designed to appear legitimate to users searching for LastPass Authenticator downloads.
Users clicking the download button are redirected through multiple GitHub pages to an attacker-controlled server. The legitimate LastPass Authenticator is available only through lastpass.com and official app stores, not GitHub repositories or third-party sites.
The malicious installer uses DLL side-loading, a technique embedding malicious code alongside legitimate Microsoft tools. The archive contains a renamed copy of vsdbg.exe, a legitimate Microsoft debugging utility, packaged with a malicious vsdbg.dll file in the same directory.
| Component | Role | SHA256 |
| vsdbg.dll | NativeAOT loader | ea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6 |
| Rapuncel stealer | Credential theft and exfiltration | aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfadd |
| Alinubx.sys | Kernel AV killer | 611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b61 |
| Browser injection DLL | Chrome and Edge app-bound key decryption | 75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40 |
| ProtectR3.dll x64, unpacked | Usermode rootkit helper present inside driver | 26db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8 |
When users execute the fake installer, Windows loads the attacker’s DLL instead of legitimate software automatically. The payload achieves SYSTEM-level administrator privileges through three escalation methods then installs a kernel-mode driver.
The driver, named Alinubx.sys by researchers, is actually a renamed copy of CcProtect.sys from a Chinese disk-encryption product. The driver maintains a list of approximately 145 antivirus and security software process names.
When loaded, it terminates every security process it identifies from kernel mode where traditional security tools cannot intervene or detect the termination. Microsoft’s Windows Hardware Compatibility Publisher signed the driver in March 2023, years before attackers weaponized it here.
With antivirus and EDR tools disabled, the stealer collects saved passwords from twenty-plus browser applications and cryptocurrency wallet files. The malware also extracts Discord, Steam, and Telegram session tokens plus Windows Credential Manager contents.
For Chrome and Edge browsers employing Google’s app-bound encryption, the stealer injects code into browser processes to request decryption services from the browser itself. Attackers compress collected data and transmit it to attacker-controlled infrastructure.
To evade detection, attackers packaged files into large ZIP archives of 148 MB and 127.9 MB, padding them with junk data to bypass size-limited security scanners. The attack server hosted impersonation pages for at least forty different brands. Researchers assessed with high confidence that the attackers constructed the loader using Cruciferra crypter, a commercial encryption tool that multiple threat groups employ.
Victims should immediately change all passwords from clean devices, review account activity, and treat affected machines as suffering kernel-level compromise requiring professional forensic examination.
