Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
-
A malicious LastPass Authenticator installer distributed through GitHub has been found to deploy a Windows kernel driver capable of disabling antivirus and endpoint detection and response (EDR) software, according to joint research from LastPass and Delphos Labs published on September 17.
The attack chain begins when a victim downloads and executes the fake installer. Once running, it drops a kernel-mode driver that terminates or disables security tooling on the host, clearing the way for a password stealer to operate without interference.
Key technical details:
- The driver is signed through Microsoft's hardware-compatibility program, lending it a legitimate signature that helps it evade scrutiny.
- At the time the researchers analyzed it, the driver scored zero detections on VirusTotal.
- The ultimate payload is a password stealer that runs only after security software has been neutralized.
The combination of a trusted Microsoft signature and clean VirusTotal results makes this sample particularly difficult to flag through signature-based or reputation-based defenses alone. Users should be cautious of installers sourced from unofficial repositories, even when the file claims to be a well-known security product.
Source: The Hacker News
Has anyone in the community observed similar abuse of Microsoft-signed drivers in their environment, and how is your team handling driver-based evasion attempts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login