Author: DigitalSpying Security Desk
Date: September 21, 2026
Executive Summary
In a sophisticated endpoint intrusion campaign demonstrating the lethal combination of brand impersonation, code-signing abuse, and kernel-level defense evasion, security researchers from LastPass and Delphos Labs have uncovered an active malware distribution pipeline disguised as the official LastPass Authenticator application. As reported by The Hacker News, the attack targets users searching for authentication software, directing them to fraudulent GitHub repository pages that rank prominently in search results.
Upon execution, the fake installer utilizes DLL side-loading of a legitimate Microsoft Visual Studio debugging tool (vsdbg.exe) to escalate privileges to NT AUTHORITY\SYSTEM. Armed with supreme administrative rights, the malware deploys a Bring Your Own Vulnerable Driver (BYOVD) attack utilizing a Windows kernel driver named Alinubx.sys. Crucially, the driver carries an authentic digital signature issued through the Microsoft Windows Hardware Compatibility Publisher program, possessed zero detections on VirusTotal upon initial inspection, and was completely omitted from Microsoft’s default driver blocklist. From Ring 0 kernel space, the driver systematically terminates 145 antivirus and Endpoint Detection and Response (EDR) processes, blinding system defenses before deploying the "Rapuncel" infostealer to siphon cryptocurrency wallets, session tokens, and browser credentials.
Deep-Dive Technical Analysis
1. Initial Access & Loader Architecture
The infection chain begins with search engine optimization (SEO) poisoning:
* The GitHub Lure: Attackers established deceptive GitHub pages (such as github.com/LastPass-Authenticator) mimicking authentic product landing pages. Clicking the download link routes victims through multiple GitHub redirects to an external server serving a padded ZIP archive (measuring between 128 MB and 148 MB to bypass automated gateway file size inspection thresholds).
* DLL Side-Loading via vsdbg.exe: The archive unpacks a legitimate, signed Microsoft debugger executable (vsdbg.exe) positioned alongside a malicious dynamic link library named vsdbg.dll. When the executable runs, Windows automatically prioritizes loading the local DLL over system directories.
* Privilege Escalation to SYSTEM: The malicious DLL loader attempts three independent privilege escalation routines, successfully acquiring NT AUTHORITY\SYSTEM before registering and launching the kernel driver as a persistent Windows service (NvFsFilter).
+----------------------------------------------------------------------------------------------------+
| BYOVD LASTPASS IMPERSONATION INTRUSION FLOW |
|---|+----------------------------------------------------------------------------------------------------+
[Victim Searches for LastPass Authenticator] ---> [Lands on Poisoned GitHub Landing Page]
|
| 1. Downloads Padded ZIP (148 MB)
v
[Executes Legitimate vsdbg.exe -> Side-Loads Malicious vsdbg.dll]
|
| 2. Escalates Privileges to SYSTEM
v
[Installs Microsoft-Signed Kernel Driver: Alinubx.sys (Signed March 2023)]
|
| 3. Driver Operates at Ring 0 (Kernel)
v
[Forcibly Terminates 145 Antivirus, EDR, & Security Processes]
(CrowdStrike, Defender, SentinelOne, Sophos Blinded from Below)
|
| 4. Deploys "Rapuncel" Password Stealer
v
[Injects into Chrome/Edge to Bypass App-Bound Encryption -> Exfiltrates Vaults & Wallets]
2. The BYOVD Vector: Subverting Microsoft Hardware Attestation
The campaign highlights an acute architectural limitation in modern operating system driver verification:
* The Provenance vs. Safety Paradox: The driver utilized, Alinubx.sys, was signed through Microsoft's official Windows Hardware Compatibility Publisher attestation pipeline in March 2023. As Delphos Labs researchers emphasized: "Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe."
* Rebranding an Existing Abuse Primitive: Analysis revealed that Alinubx.sys is a renamed derivative of CcProtect.sys, a known process-terminating driver originating from the Chinese disk-encryption software CnCrypt (cataloged in the open-source LOLDrivers repository).
* The Blocklist Hashing Blind Spot: Microsoft's vulnerable driver blocklist relies on static cryptographic file hashes. Because the adversary renamed the binary and altered internal description fields, the calculated hash differed from known samples, allowing the driver to load unimpeded on modern Windows 11 systems.
3. Kernel-Level Defense Blinding & App-Bound Encryption Bypass
Operating with Ring 0 kernel authority, the driver executes devastating operational tradecraft:
* The 145-Process Kill List: The driver contains an embedded array of 145 security process names. By terminating processes directly from kernel space, user-mode hooks and monitoring agents cannot intervene, log alerts, or prevent termination.
* Bypassing App-Bound Encryption: Modern Chromium browsers (Google Chrome and Microsoft Edge) implement App-Bound Encryption, which ties DPAPI credential keys to specific application identities to block external stealers. To circumvent this, the Rapuncel stealer injects directly into the running browser process, commanding the browser’s own authenticated helper services to decrypt stored credentials on its behalf.
* Targeted Vault Scope: The stealer extracts passwords and cookies across 24 browsers, unencrypted cryptocurrency wallet files (wallet.dat, seed phrases), Windows Credential Manager entries, and active session tokens for Discord, Steam, and Telegram.
4. Technical Indicators & Detection Attributes
Threat Component
Forensic Artifact / Telemetry Detail
Service Name
NvFsFilter
Driver File Path
C:\Windows\System32\drivers\nvfsflt64.sys
Device Endpoint
\\.\Alinubx
Digital Certificate Signer
Henan Dafeng Software Co., Ltd. / CnCrypt
Delivery Mechanism
DLL side-loading via vsdbg.exe -> vsdbg.dll
Malware Family
Cruciferra crypter loader delivering Rapuncel (BoryptGrab lineage)
Industry Impact: The Expanding BYOVD Crisis
The attack underscores how commodity cybercrime actors are adopting sophisticated kernel exploitation tradecraft:
* Commoditization of Kernel Process Killers: Commercial crypters (such as Cruciferra) now bundle modular, pre-signed Windows kernel drivers as standard features, enabling low-skilled cybercrime syndicates to completely neutralize enterprise endpoint detection suites.
* The Abuse of Open Developer Ecosystems: Attackers increasingly weaponize GitHub and package registries to host brand impersonation lures, exploiting developer and consumer trust in legitimate domains to bypass corporate URL filtering.
Strategic Recommendations & Actionable Defenses
1. Endpoint Hardening & Driver Control
* Enable Windows Defender Application Control (WDAC): Deploy WDAC policies that restrict driver loading based on explicit publisher certificates and strict file attributes, rather than relying solely on default hash blocklists.
* Enforce Hypervisor-Protected Code Integrity (HVCI): Ensure Memory Integrity / HVCI is enabled across all Windows 11 endpoints to restrict unauthorized kernel memory modifications.
2. Threat Hunting Queries
* Search Windows Event Logs for Event ID 7045 (Service Creation) matching service name NvFsFilter or binary path nvfsflt64.sys.
* Monitor for rapid, sequential termination of security processes (e.g., MsMpEng.exe, CSFalconService.exe, SentinelAgent.exe) initiated outside standard management mechanisms.
3. Incident Remediation Protocol
* If an endpoint executed the fake installer, treat the host as a full kernel compromise. Isolate the machine from the corporate network and perform a complete bare-metal operating system re-image.
* Instruct the user to immediately rotate all corporate, personal, and cryptocurrency passwords from a known-clean secondary device.