Researchers from LastPass and Delphos Labs found a fake LastPass Authenticator installer being shared through a fraudulent GitHub page that appears near the top of search results. The attacker set up a page at github.com/LastPass-Authenticator to trick people looking for the official LastPass Authenticator download.
If someone clicks the download button, they are sent through several GitHub pages before landing on a server controlled by the attacker. The real LastPass Authenticator can only be downloaded from lastpass.com or official app stores, not from GitHub or other websites.
The fake installer uses a method called DLL side-loading, which hides harmful code next to real Microsoft tools. The download includes a renamed version of vsdbg.exe, a real Microsoft debugging tool, along with a harmful vsdbg.dll file in the same folder.
When someone runs the fake installer, Windows automatically loads the attacker’s DLL instead of the real software. The malware then uses three different methods to gain SYSTEM-level administrator rights and installs a driver that runs in the core of the operating system.
Researchers found that the driver, called Alinubx.sys, is really just a renamed version of CcProtect.sys, which comes from a Chinese disk-encryption tool. This driver keeps a list of about 145 antivirus and security software process names.
Once the driver is running, it shuts down any security process it recognizes from deep within the system, where normal security tools can’t stop or even see it happening. Microsoft signed this driver in March 2023, long before attackers started using it for these attacks.
After disabling antivirus and EDR tools, the malware steals saved passwords from over twenty different browsers and grabs files from cryptocurrency wallets. It also takes session tokens from Discord, Steam, and Telegram, as well as information stored in the Windows Credential Manager.
For Chrome and Edge browsers that use Google’s app-bound encryption, the malware injects its own code into the browser and asks it to decrypt the data. The attackers then compress all the stolen data and send it to their own servers.
To avoid being caught, the attackers put the files into large ZIP archives—148 MB and 127.9 MB—by adding extra junk data so they could slip past security scanners that check file size. Their server also hosted fake pages for at least forty different brands. Researchers are confident that the attackers built the loader using Cruciferra crypter, a commercial encryption tool used by several threat groups.
Anyone affected should quickly change all their passwords using a device that is not infected, check their account activity, and treat any compromised computers as if they have a deep system-level infection that needs professional forensic help.
