Ring 0 Sabotage: Fake LastPass Authenticator Abuses Microsoft-Signed Kernel Driver to Blind EDRs and Deploy Rapuncel Stealer
Date: September 22, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Malware Analysis / Endpoint Security / Threat Intelligence
Tags: LastPass, BYOVD, Kernel Driver, EDR Killer, Rapuncel Stealer, Windows Defender, Ring 0
Executive Summary
In a sophisticated attack highlighting the dangerous intersection of brand impersonation and kernel-level sabotage, threat actors have begun distributing a fake desktop version of the LastPass Authenticator via search-engine-poisoned GitHub repositories. Joint threat intelligence disclosures published on September 17–21, 2026, by the LastPass TIME Team and Delphos Labs reveal that the fraudulent installer deploys a legitimate, Microsoft-attested Windows kernel driver (.sys) to systematically disable endpoint detection and response (EDR) agents before unleashing a newly discovered infostealer dubbed Rapuncel.
The campaign exploits the Bring Your Own Vulnerable Driver (BYOVD) technique. Because the deployed driver was legitimately certified through Microsoft's Windows Hardware Quality Labs (WHQL) program, it effortlessly circumvents 64-bit Windows Driver Signature Enforcement (DSE). The driver had zero detections on VirusTotal and had not been indexed on Microsoft’s default Vulnerable and Malicious Driver Blocklist.
Operating from Ring 0 (kernel space), the driver manipulates executive process structures to neutralize user-mode protections and forcefully terminate core security agents—including Microsoft Defender, CrowdStrike Falcon, and SentinelOne. With the host completely blinded, the secondary payload, Rapuncel Infostealer, harvests browser credentials, two-factor authentication tokens, session cookies, and cryptocurrency wallet extensions.
LastPass has confirmed that no internal corporate infrastructure, customer vaults, or production services were compromised; the attackers exclusively leveraged the LastPass brand as a high-conversion social engineering lure.
Technical Deep-Dive: Anatomy of the Kernel-Level Kill Chain
The attack combines advanced search engine optimization (SEO) lure distribution with low-level Windows kernel exploitation.+-----------------------------------------------------------------------------------+
| BYOVD KERNEL-BLINDING ATTACK CHAIN |
|---|
Victim Search (Google / Bing) Fake GitHub Repository Attacker Staging Server
| | |
| 1. Query: "LastPass Authenticator" | |
|-------------------------------------->| |
| | 2. Redirect to Download |
| |-------------------------------->|
| 3. Download Inflated Installer.zip | |
|<------------------------------------------------------------------------|
|
| [EXECUTION ON ENDPOINT]
|
+---> User executes `LastPass_Authenticator_Setup.exe` (UAC prompt accepted)
|
| [RING 3: USER MODE]
| - Unpacks legitimate WHQL Microsoft-Signed Kernel Driver (`vulnerable.sys`)
| - Registers service via Service Control Manager (`sc.exe create ...`)
|
v [RING 0: KERNEL SPACE]
+---------------------------------------------------------------------------+
| Driver loads with full kernel privileges (Bypasses Driver Signature Enf.) |
| - Receives IOCTL control codes from User-Mode Dropper |
| - Unregisters kernel notification callbacks (`ObRegisterCallbacks`) |
| - Strips Protected Process Light (PPL) bits from security processes |
| - Forcefully terminates EDRs: MsMpEng.exe, CSFalconService.exe |
+---------------------------------------------------------------------------+
|
| [ENDPOINT DEFENSES BLINDED]
|
v [PAYLOAD EXECUTION]
+---> Drops and executes Rapuncel Infostealer
- Scrapes Chromium / Gecko passwords, cookies, credit cards
- Extracts DPAPI keys and crypto wallet extensions
- Exfiltrates encrypted archive to C2 server
1. The SEO Poisoning & GitHub Staging Mechanism
Adversaries established fraudulent GitHub organizations and repositories (including github.com/LastPass-Authenticator) designed to mirror authentic LastPass product landing pages. Utilizing algorithmic SEO manipulation and keyword stuffing, these repositories achieved top-tier visibility in web search results for queries such as "LastPass Authenticator download" and "LastPass desktop app".
When visitors clicked the prominent download link, the page redirected through a series of intermediate staging domains to serve a multi-gigabyte ZIP archive. The executable inside was artificially inflated with binary zero-padding (0x00 bytes) to exceed 500 MB—a deliberate tactic designed to bypass automatic file submission limits on automated cloud sandbox analysis engines and email gateway scanners.
2. The BYOVD Weaponization Vector
Windows requires all 64-bit kernel-mode drivers to carry a valid digital signature issued by a trusted certification authority verified by Microsoft (Driver Signature Enforcement). To bypass this barrier without purchasing expensive leaked certificates, advanced attackers employ BYOVD:
1. The installer drops a legitimate, previously signed third-party driver containing known, exploitable buffer overflow or arbitrary kernel memory read/write primitives.
2. Because the driver binary was digitally signed by Microsoft's WHQL process, Windows loads it without triggering security warnings.
3. The user-mode malware obtains a handle to the driver using CreateFile("\\\\.\\VulnerableDevice", ...) and dispatches malicious Input/Output Control (IOCTL) codes.
In this campaign, Delphos Labs identified that the bundled driver featured an unauthenticated IOCTL handler allowing user-mode processes to perform arbitrary read and write operations against physical and virtual kernel memory (\Device\PhysicalMemory).
3. Neutralizing EDR & Antivirus (The Ring 0 Advantage)
Modern Endpoint Detection and Response (EDR) solutions run their primary analysis engines as protected user-mode services. To prevent malicious user-space applications from killing them, Windows employs Protected Process Light (PPL), which restricts processes—even those running with administrative NT AUTHORITY\SYSTEM privileges—from opening PROCESS_TERMINATE handles to security software.
By obtaining Ring 0 code execution via the vulnerable driver, the attacker circumvents PPL entirely:
* Modifying the EPROCESS Structure: The driver traverses the active kernel process list (ActiveProcessLinks) to locate target security processes:
* MsMpEng.exe & NisSrv.exe (Microsoft Defender)
* CSFalconService.exe (CrowdStrike Falcon)
* SentinelAgent.exe (SentinelOne)
* FortiEDR.exe (Fortinet)
* Stripping PPL Flags: In the kernel, each process is represented by an EPROCESS memory structure containing a _PS_PROTECTION byte field. The driver zeros out this byte, instantly demoting the EDR process from Protected Process Light to standard user mode.
* Kernel Callback Unhooking: The driver nullifies process creation and thread creation notification routines registered in PspCreateProcessNotifyRoutine and PspCreateThreadNotifyRoutine arrays.
* Direct Process Termination: Once protections are stripped, the driver invokes internal kernel primitives (ZwTerminateProcess) to cleanly kill the EDR daemons without generating alerting telemetry.
4. Payload Detonation: The Rapuncel Infostealer
With the host stripped of operational telemetry and active defenses, the malware launches Rapuncel Infostealer:
* Browser Data Harvesting: Targets all Chromium-based (Chrome, Edge, Brave, Opera) and Gecko-based (Firefox) browsers, extracting encrypted SQLite databases containing stored credentials, autofill data, credit cards, and active session cookies.
* DPAPI Key Extraction: Decrypts master password hashes utilizing the local Data Protection API (DPAPI) master keys extracted from memory.
* Cryptocurrency & 2FA Wallet Extraction: Scans standard extension storage paths for cryptocurrency wallets (MetaMask, Coinbase Wallet, Phantom, Binance Wallet) and authenticator desktop storage files.
* Exfiltration Channel: The gathered data is bundled into a password-protected ZIP archive and exfiltrated via HTTPS POST requests to attacker-controlled cloud endpoints and backup Telegram bot APIs.
Threat Landscape Comparison: Why BYOVD Remains an Asymmetric Threat
Attack Category
Threat Mechanism
Detection Difficulty
User-Mode Malware
Relies on living-off-the-land binaries (LOLBins) or unhooking DLLs in user space.
Low to Moderate: Caught by behavioral EDR telemetry, memory scanners, and AMSI.
Traditional Rootkits
Requires unsigned drivers or test-signing mode.
Low: Blocked outright by Windows Secure Boot and Driver Signature Enforcement.
BYOVD (Bring Your Own Vulnerable Driver)
Deploys genuine, Microsoft-certified drivers containing exploitable memory primitives.
Extremely High: Driver possesses authentic cryptographic signatures; blinds EDR from Ring 0 before behavioral rules can trigger.
Critical Mitigation & Defensive Blueprint
Defeating BYOVD attacks requires architectural defenses that operate below or alongside the Windows kernel.
1. Enable Hypervisor-Protected Code Integrity (HVCI)
HVCI (Memory Integrity), part of Virtualization-Based Security (VBS), uses the CPU hardware hypervisor to isolate kernel memory:
* Even if a vulnerable driver is loaded, HVCI prevents the execution of unsigned code within kernel memory pages.
* Ensure HVCI is strictly enabled across all fleet devices:
* Open Windows Security -> Device Security -> Core Isolation -> toggle Memory Integrity to ON.
* Enterprise GPO / Intune: Computer Configuration -> Administrative Templates -> System -> Device Guard -> Turn On Virtualization Based Security -> Hypervisor Enforced Code Integrity = Enabled.
2. Enforce the Microsoft Vulnerable Driver Blocklist via WDAC
Microsoft maintains a catalog of known vulnerable drivers. However, synchronization is not always instantaneous:
* Deploy custom Windows Defender Application Control (WDAC) policies in enforce mode to block known vulnerable drivers based on hash and certificate attributes.
* Subscribe to the open-source LOLDrivers project blocklist and integrate updated hashes into security baselines.
3. Software Procurement & Download Hygiene
* Strict Brand Validation: Educate staff that enterprise authenticators (such as LastPass Authenticator) are official mobile and desktop applications downloaded exclusively from official corporate portals (lastpass.com), Google Play, or the Apple App Store—never from GitHub repositories or third-party file sharing platforms.
* Block High-Risk GitHub Subdomains: Restrict developer and standard workstation downloads from unverified GitHub project release pages unless cryptographically verified.
4. SOC Threat Hunting & Telemetry Ingestion
Security Operations Centers must monitor for driver installation events and abrupt EDR termination:
* Event ID 7045 (System Event Log): A new service was installed (look for unfamiliar .sys file paths, especially originating from C:\Users\*\AppData\Local\Temp\ or C:\ProgramData\).
* Sysmon Event ID 6: Driver loaded. Correlate loaded driver hashes against known vulnerable driver repositories.
* Sudden Heartbeat Loss: Alert immediately when an EDR agent ceases sending heartbeat telemetry without a corresponding system shutdown event.
Indicators of Compromise (IoCs)
* Lure Repository / Distribution URL:
* github.com/LastPass-Authenticator
* lastpass-authenticator-download[.]com
* Vulnerable Kernel Driver Hash:
* SHA256: 9e1c2b3a4f5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f
* Rapuncel Stealer Payload:
* LastPass_Authenticator_Setup.exe (SHA256: 4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b)
* Observed C2 Exfiltration Endpoints:
* https://auth-sync-gateway[.]net/api/v1/sync
* https://api.telegram.org/bot/sendMessage
For technical threat advisories, exploit breakdowns, and real-time cybersecurity coverage, follow Digital Spying.