Malicious LastPass Installer Disables Antivirus Software, Steals Passwords

A malicious installer for LastPass Authenticator on GitHub was used to install a Windows kernel driver that disables antivirus and security software, allowing a password stealer to run undetected. The fake installer is signed by Microsoft's hardware-compatibility program and has evaded detection by antivirus software.

The driver, named Alinubx.sys, is a renamed copy of the CcProtect.sys driver from the Chinese disk-encryption product CnCrypt. It carries a list of 145 antivirus and security process names and terminates each one it finds running. The driver's code can also hide files, inject into other programs, and reroute web traffic.

The attackers used the Cruciferra crypter to build the loader, which has been used in previous malware campaigns. The stealer, named Rapuncel by LastPass, copies saved passwords from browsers, cryptocurrency wallet files, and login sessions for various services. It then sends this data to an attacker server.

LastPass says none of its own systems or customer vaults were affected, but warns users who ran the fake installer to change their passwords immediately and review account activity for any suspicious behavior. The researchers recommend hunting for signs of the driver's lineage and behavior rather than one file name, as the attackers can easily rename the driver.