A Microsoft-attested driver terminated 145 antivirus processes from kernel mode

A publisher allowlist is a string comparison. An antivirus reputation lookup is an API call. Both are close to free to operate, which is why they sit near the front of most endpoint policies. Both returned a pass on this sample: the driver chained to Microsoft Windows Hardware Compatibility Publisher, and VirusTotal scored it clean ^[3]. What distinguished it from a legitimate signed driver only appeared once it ran, when it began killing antivirus and EDR processes from kernel mode ^[4].

Brand-level response scales badly against this operation. The LastPass lure was one frame in a campaign impersonating at least 40 companies, with multiple operators running lures in parallel off shared infrastructure and a crypter kit ^[1][7]. Removing the fake LastPass Authenticator organization clears roughly 2.5 percent of the known brand surface ^[16], and the report says new lure pages can be deployed on demand using the same kit ^[11]. A second impersonation page, advertising a "macOS LastPass" product, went offline before the LastPass team could investigate it ^[14].

The board-deck version of the control is that unsigned binaries and known-bad files are blocked, and that description survives this incident intact. The description leaves out what the alternative costs. Denying kernel driver loads unless explicitly approved moves spending from detection to exception handling, because every approval becomes a ticket someone has to work. The signal that would have caught this driver was behavioural.

Blocking by operator has nothing settled to key on. Delphos Labs attributes the loader with high confidence to the Cruciferra PUROSANGUE crypter package or a close derivative, which Proofpoint documented in 2025 ^[8]. On the campaign, the two teams assess there may be overlap with the BoryptGrab activity Trend Micro documented in March 2026. They say the evidence is insufficient to conclude it is the same campaign or the same operator ^[9]. The report also states that evidence is incomplete on the full scope of targeted brands, the driver's command-and-control configuration, and the operator structure behind the malware-as-a-service backend ^[12].

The two decisions here run on different timescales. Attestation signing for Windows kernel drivers is a problem for Microsoft and the driver ecosystem to work on over years, and no operator decision this quarter touches it. The decision available this quarter is narrower: whether a search-ranked code-hosting page counts as a software source in the acquisition policy. Who owns that answer when a user types a product name into a search box ^[13]? LastPass put its own position in the report: "GitHub is not a LastPass distribution channel." The authenticator ships through lastpass.com and the official app stores ^[15].

LastPass dated its findings to September 10, 2026, 28 days after the first sighting on August 13 ^[17], and warned that domains are taken down and payload servers rotate between writing and reading ^[11]. The team asked researchers who have looked at Rapuncel, Alinubx.sys or the albinofennel[.]com kit to write to [email protected] ^[19].