The attack chain begins when a victim downloads and executes the fake installer. Once running, it drops a kernel-mode driver that terminates or disables security tooling on the host, clearing the way for a password stealer to operate without interference.

Key technical details:

• The driver is signed through Microsoft's hardware-compatibility program, lending it a legitimate signature that helps it evade scrutiny.
• At the time the researchers analyzed it, the driver scored zero detections on VirusTotal.
• The ultimate payload is a password stealer that runs only after security software has been neutralized.

The combination of a trusted Microsoft signature and clean VirusTotal results makes this sample particularly difficult to flag through signature-based or reputation-based defenses alone. Users should be cautious of installers sourced from unofficial repositories, even when the file claims to be a well-known security product.

Source: The Hacker News

Has anyone in the community observed similar abuse of Microsoft-signed drivers in their environment, and how is your team handling driver-based evasion attempts?