A Microsoft-signed kernel driver carrying a 145-entry kill list for antivirus and EDR processes scored zero detections on VirusTotal in August, then shut down security software from the kernel so a password stealer could harvest saved credentials, researchers at LastPass and Delphos Labs reported on September 17.
How the fake LastPass Authenticator installer worked
Victims were lured by a convincing GitHub page at github.com/LastPass-Authenticator that ranked in search results for phrases such as "LastPass Authenticator download." Clicking the repository's download flow redirected users through multiple GitHub pages to an attacker-controlled server that served a large ZIP archive. The real LastPass Authenticator, LastPass stresses, comes from lastpass.com and official app stores—not GitHub.
Inside the ZIP the researchers found a renamed copy of a legitimate Microsoft debugging tool, vsdbg.exe, placed beside a malicious vsdbg.dll. When Windows loads the debugger, it also loads the attacker's DLL from the same folder (DLL side‑loading). That loader then attempted three privilege‑escalation methods, attained SYSTEM, and installed a kernel driver as a service. The archives observed were 148 MB and 127.9 MB and were padded with junk files so scanners with size limits would often skip them.
The Microsoft-signed driver: Alinubx.sys and why Windows trusted it
Delphos Labs named the driver Alinubx.sys. The file is a renamed copy of CcProtect.sys, a driver from the Chinese disk‑encryption product CnCrypt. Both drivers share product name, version, and submitter; only filename and description were changed. The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain with a signing date of March 2023.
Because the driver carried a legitimate Microsoft attestation, Windows treated it as trusted. From the kernel the driver terminated running security processes by name—145 entries in the kill list—so user‑mode antivirus and EDR tools could not prevent or observe the kills. Delphos notes this is a classic bring‑your‑own‑vulnerable‑driver (BYOVD) pattern: a signed, abusable driver opens kernel‑level capabilities that user‑mode protections cannot block.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat the stealer took and how it exfiltrated data
With security software down, the deployed stealer collected data from more than two dozen browsers, cryptocurrency wallet files, Discord, Steam, and Telegram login sessions, the contents of Windows Credential Manager, and local files named like "password," "seed," or "recovery." For Chrome and Edge—whose app‑bound encryption is designed to protect saved passwords—the stealer injected into the browser process and asked the browser's own service to decrypt stored passwords. The harvested data were packed into a ZIP and sent to an attacker server.
The researchers observed that the driver's code could also hide files, inject into other programs, and reroute web traffic, but those extra capabilities require a configuration file the attackers did not include in the samples examined.
Detection, reporting, and Microsoft’s response
Delphos checked detection and Microsoft blocklist status in August. The original CcProtect.sys showed about 7 detections among roughly 70 engines in August; the renamed Alinubx.sys scored zero. Delphos checked the Microsoft vulnerable‑driver blocklist on August 20 and found neither the original nor the renamed driver listed. The blocklist matches file hashes; renaming or recompiling produces a different hash and so will not match an existing entry.
Delphos reported the driver to Microsoft on August 19. Microsoft responded that the driver's behavior did not meet its definition of a security vulnerability because the driver is not a Microsoft component, and directed Delphos to the separate channel used to consider drivers for the blocklist. Delphos resubmitted via that channel the same day. As of the September 17 report, Alinubx.sys remained not listed on the blocklist.
What defenders can hunt for, and immediate steps if you ran the installer
The researchers recommend hunting for the driver's lineage and behavior rather than a single filename. Specific indicators to watch for include:
- Service name: NvFsFilter
- Driver file: C:\Windows\System32\drivers\nvfsflt64.sys
- Signer details that name Henan Dafeng Software or contain "CnCrypt"
- Device path: \\.\Alinubx
- Behavioral pattern: a driver load followed by security processes being killed
If you ran the fake installer, treat every password saved in the browser on that machine as compromised, along with any wallet files, Discord, Steam, and Telegram sessions, and entries in Windows Credential Manager. The stealer exfiltrates credentials before the driver begins its kills, and the driver persists: it re‑kills security tools and re‑runs the stealer on every reboot. Change passwords from a separate, clean device; where possible, subject the affected machine to a kernel‑level forensic check or rebuild the system.
What this means for defenders, LastPass users, and procurers of signed drivers
Defenders should prioritize behavioral telemetry that reveals kernel‑level driver loads and rapid termination of security processes rather than relying on static signature matches. LastPass users specifically should source authenticator software only from lastpass.com or official app stores, and treat any browser‑stored credentials on a machine that ran this payload as compromised—LastPass said its systems, services, and customer vaults were not touched and that attackers only borrowed the company name.
Procurement and platform teams that manage driver allowlists should note the blocklist used here matches hashes and therefore can be evaded by renaming or recompilation; the researchers attribute the loader to builds created with the paid Cruciferra crypter and assess with high confidence that Cruciferra's default kill list aligns with the 145 entries observed.
Delphos and LastPass have published indicators and a joint report; the community detection on LOLDrivers matches by hash and therefore shares that same fragility if the file changes. How many systems were infected remains unknown.
