A malicious installer masquerading as the LastPass Authenticator application hijacks Microsoft-signed kernel drivers to disable endpoint protection before deploying a password stealer. Researchers at LastPass and Delphos Labs disclosed the attack on September 17, revealing a supply chain compromise targeting GitHub users.
The attack chain begins when victims download what appears to be the legitimate LastPass Authenticator from GitHub. Upon execution, the installer loads a Windows kernel driver that carries a valid Microsoft signature through the company's hardware-compatibility verification program. This legitimacy allows the driver to execute at the kernel level without triggering security warnings. Once loaded, the driver systematically terminates antivirus and endpoint detection and response (EDR) processes before a credential-stealing payload deploys.
The kernel driver initially registered zero detections on VirusTotal, meaning it bypassed signature-based detection engines across multiple security vendors. This detection gap highlights a critical vulnerability in how security tools approach kernel-level threats. Attackers exploit the trust placed in Microsoft-signed drivers to bypass the very protections designed to stop them. The technique represents a sophisticated understanding of Windows security architecture and demonstrates how legitimate code-signing mechanisms become weapons when abused.
The GitHub distribution vector suggests the attackers maintained a lookalike repository or compromised an existing one. GitHub remains a common vector for supply chain attacks because developers frequently trust open-source repositories without verifying authenticity. LastPass users specifically faced risk because the authenticator integrates tightly with password management workflows, making credential theft particularly valuable.
This attack relies on a technique known as bring-your-own-vulnerable-driver (BYOVD). Rather than discovering a zero-day vulnerability in a legitimate driver, attackers package drivers with known vulnerabilities alongside their malware. Once the compromised driver loads at kernel level, it disables security software before the second-stage payload executes. Dozens of legitimate Windows drivers contain exploitable vulnerabilities, creating an expansive toolkit for attackers willing to invest in kernel-level malware development.
The password stealer component represents the true objective. Once antivirus and EDR protections fall silent, the malware harvests credentials stored in browsers, password managers, and operating system caches. Compromised credentials grant attackers initial access to corporate networks, email accounts, and cloud services. For organizations using LastPass Enterprise, a single compromised user account could unlock access to hundreds of critical systems.
Organizations should assume the fake installer circulated for an unknown duration before detection. Any systems where employees downloaded and executed code claiming to be LastPass Authenticator require immediate investigation. Security teams should search for process terminations of antivirus services, kernel driver installations from unexpected sources, and credential access indicators in logs.
LastPass recommends downloading the legitimate authenticator exclusively from official channels: the Microsoft Store, Apple App Store, or the official LastPass website. GitHub offers no verification mechanism preventing attackers from creating repositories with names nearly identical to legitimate projects. Users should verify download sources and check digital signatures when available.
The incident underscores how kernel-level attacks bypass traditional defenses. EDR solutions protecting user-space processes cannot detect threats executing at kernel privilege. Organizations pursuing advanced threat protection need kernel-mode monitoring and driver signature validation alongside conventional endpoint solutions.