A Microsoft-signed driver in a fake LastPass installer kills 145 security processes from the kernel

The kill runs in kernel mode, below the layer where user-mode security agents live, so those agents cannot block it and cannot record it ^[7]. The signature is what makes that cheap. Alinubx.sys is signed through the Microsoft Windows Hardware Compatibility Publisher chain with a signing date of March 2023, years ahead of this campaign, and Windows trusts it on sight ^[8]. This is bring your own vulnerable driver with one change: the attackers run the driver exactly as designed ^[9].

Microsoft's vulnerable driver blocklist, which the source describes as the control most teams assume covers this case, has been enabled by default since the Windows 11 2022 Update ^[10]. It matches known file hashes, so any rename or recompile produces a hash the list does not carry ^[11]. In this case the original was never on the list in the first place ^[12].

The rename did change what scanners said. In August the known original was flagged by 7 of roughly 70 antivirus engines, and the renamed copy was flagged by none of them ^[13]. That is about one engine in ten on a file with public proof-of-concept code, and zero once the file name and description changed ^[1]. The two files share product name, version and submitter ^[14]. The renamed driver itself scored zero detections on VirusTotal when researchers checked it in August ^[3].

The joint LastPass and Delphos Labs analysis, published September 17, is direct about what the signature proves ^[2]. "Microsoft attestation proves a driver passed through a trust pipeline. It does not prove the driver is safe," the researchers wrote ^[15]. Their recommendation is to treat Windows Hardware Compatibility Publisher signing as provenance metadata, and not to let driver allowlisting stop at "signed by a Microsoft chain" ^[16].

Delphos reported the driver to Microsoft on August 19, one day before it checked the blocklist ^[17][2]. Microsoft directed the researchers to a separate channel that evaluates such submissions ^[18].

The delivery side is cheaper to stop than the driver. The archives observed were 148 MB and 127.9 MB, padded with junk files so that scanners enforcing a maximum file size skip them entirely ^[19]. Inside sits a renamed copy of vsdbg.exe, a legitimate Microsoft debugging tool, next to a malicious file called vsdbg.dll, so running the fake installer makes Windows load the attacker's DLL from the same folder ^[20]. The loader then tries three separate routes to administrator rights, reaches SYSTEM, and registers the kernel driver as a service ^[21]. The genuine LastPass Authenticator ships from lastpass.com and the official mobile app stores ^[22].

The driver's code also supports hiding files, injecting into other programs and rerouting web traffic, but those functions require a configuration file the operators did not include, so they stayed dormant ^[23]. LastPass says none of its own systems, services or customer vaults were touched ^[24]. A user who ran the file lost every credential stored on that machine, whichever password manager they use ^[25].