Why a verified Microsoft signature was not enough to save LastPass users

I spent a late night last month analyzing a GitHub repository that looked exactly like a standard corporate project page. It had the right logos, a clean README file, and a download button that promised a quick installation of a security tool. If I were in a rush to set up a new workstation, I might have clicked it. This is the exact psychological trap used in a recent campaign targeting LastPass users. The attackers did not breach the password manager itself. Instead, they built a mirror image of legitimacy on a platform we usually trust.

From a risk perspective, this incident is a reminder that the source of a file is just as important as the file itself. GitHub is a home for millions of open-source projects, but it is not an official app store for proprietary security software. Between August and September 2026, a threat actor used this ambiguity to distribute a sophisticated infostealer. The operation involved fraudulent GitHub organizations, kernel-level drivers, and clever techniques to bypass modern browser security. Looking at the threat landscape, this is a clear shift toward targeting the tools we use to stay secure.

The deception of a familiar domain

Behind the scenes, the attack started with search engine optimization. When users searched for terms like "LastPass Authenticator download," they were directed to a GitHub organization at github[.]com/LastPass-Authenticator. This page was a carefully crafted lure. It used LastPass branding and included badges that claimed the software was "VirusTotal Approved." These visual cues are designed to lower a user's guard. We are trained to look for green checkmarks and familiar names. When we see them on a site as reputable as GitHub, our brain treats the download as safe.

This setup was not a standalone incident. Researchers at LastPass and Delphos Labs identified that the same infrastructure impersonated over 40 different companies. The attackers used a chain of redirects involving multiple GitHub Pages accounts and external domains. By design, this allowed them to swap out the final malware server whenever one was blocked without needing to change the initial lure on the main GitHub page. This modularity makes the campaign resilient against simple domain blacklisting.

Bloated archives and the art of evasion

Once a victim clicked the download button, they received a ZIP archive. The file was surprisingly large, reaching up to 148 MB. In a world of high-speed internet, we rarely question a large download, but in the context of malware, size is often a defensive tactic. Attackers fill these archives with junk data to exceed the file-size limits of automated malware scanners. Many cloud-based security tools skip files over a certain threshold to preserve processing power. This simple trick ensures the payload arrives on the victim's machine without an initial alert from a gateway scanner.

Inside the archive was a multi-stage infection chain. The malware did not just run a malicious script. It abused a legitimate Microsoft debugging tool called vsdbg.exe. This is a technique known as DLL side-loading. The attackers placed a malicious library in the same folder as the trusted Microsoft executable. When vsdbg.exe started, it automatically loaded the malicious file, believing it was a required component. Consequently, anyone monitoring the system would see a legitimate Microsoft process running in the background while the malware executed its first stage.

The kernel level bouncer

At the architectural level, the most dangerous part of this infection is a driver called Alinubx.sys. The malware installs this driver and disguises it as an NVIDIA component to blend in with standard system files. A kernel driver operates at the highest privilege level of the operating system. If we think of security software as a VIP club bouncer at every internal door, this driver is the corrupt owner who can fire the bouncers at will.

Alinubx.sys contained a hardcoded list of 145 different antivirus and endpoint detection processes. Because it ran in kernel mode, it could terminate these security tools before they had a chance to flag the suspicious activity. The driver was part of the CnCrypt family, which is known for its ability to disable system protections. Perhaps most concerning is that the driver was signed through the Microsoft Windows Hardware Compatibility Publisher chain. This signature gave it a stamp of official approval, meaning Windows would load it without complaint. Proactively speaking, a signed driver is a nightmare for defenders because it bypasses the basic integrity checks that usually stop unauthorized kernel code.

Bypassing the browser vault

Once the security software was out of the way, the primary payload, an infostealer called Rapuncel, began its work. The goal was total data exfiltration. It targeted browser passwords, cryptocurrency wallets, Discord tokens, and Telegram sessions. It also took screenshots and searched for sensitive documents on the local drive. From an end-user perspective, the theft is invisible. There are no pop-ups or system slowdowns while the data moves to the attacker's server.

Rapuncel included a specific method to bypass the app-bound encryption found in modern versions of Chrome and Edge. This encryption is meant to prevent external programs from reading stored passwords. To get around this, the malware injected code directly into the browser process itself. By operating from within the trusted process, it could request the decrypted passwords as if it were the legitimate user. The malware then compressed all this data and sent it to a command-and-control server. This level of technical effort shows that attackers are actively developing ways to defeat the specific defenses built into our most common applications.

Recovery steps for the compromised

If you downloaded software from the LastPass-Authenticator GitHub page, you must assume your system is fully compromised. Because the malware installs a kernel driver, a standard antivirus scan from within Windows may not be enough to clean the infection. The driver can hide itself from the operating system or simply disable the scanner as it runs. The safest path forward is to perform remediation from a separate, clean environment or to wipe the machine entirely.

• Stop using the affected computer immediately for any sensitive activity.
• Use a separate, trusted device to change every password that was stored in your browser or your LastPass vault.
• Revoke active sessions for services like Discord, Telegram, and Steam to kick the attacker out of your accounts.
• Move any funds in cryptocurrency wallets to new, secure addresses.
• Enable hardware-based multi-factor authentication where possible, as this is harder to intercept than session tokens.

Remediation should involve booting the system in Safe Mode or using an offline recovery tool to remove the Alinubx.sys driver and the associated malicious files. Relying on a reactive approach is dangerous here. The malware has already had the chance to steal your digital identity, and the priority is to cut off its access to your accounts.

Lessons in repo trust

This campaign demonstrates that the network perimeter is no longer the castle moat we once thought it was. Attackers are moving up the stack to target the trust we place in platforms like GitHub. We often treat a GitHub URL as a badge of safety, but it is just another piece of the internet that requires scrutiny. Shadow IT and unofficial downloads are the dark matter of your personal or corporate security. They are often invisible until they cause a massive impact.

LastPass confirmed that their own systems were not involved in this incident. This was an attack on the users, not the provider. The incident teaches us that even when a tool is designed to protect us, the way we acquire that tool is a vulnerability. Always verify the distribution channel for software. Official websites and primary app stores are the only places where you should source security applications. If a link feels convenient but looks slightly out of place, it is a risk that is not worth taking.

Sources: LastPass Security Report, Delphos Labs Malware Analysis, Trend Micro BoryptGrab Documentation.

Disclaimer: This article is for informational and educational purposes only and does not replace a professional cybersecurity audit or incident response service.