Fake LastPass Authenticator Installer Deploys BYOVD Security-Disabling Kernel Driver

Since at least August 2026, threat actors have been distributing a sophisticated credential-stealer masquerading as the LastPass Authenticator tool via deceptive GitHub repositories. The campaign relies on search engine optimization to lure victims into downloading a ZIP archive padded with junk data to bypass file-size scanning limits. Upon execution, the malware utilizes DLL side-loading to gain system-level privileges and deploy a kernel-mode driver, identified by researchers as a renamed version of the CnCrypt 'CcProtect.sys' driver. Although the driver carries a legitimate Microsoft hardware compatibility signature, it is used to perform a 'Bring Your Own Vulnerable Driver' (BYOVD) attack, specifically targeting and terminating over 145 known security and EDR processes. Once security tools are incapacitated, the 'Rapuncel' stealer harvests saved credentials from browsers, cryptocurrency wallets, and session tokens for applications like Discord and Telegram. The attack maintains persistence by re-executing the driver and stealer upon system reboot.

Attack Chain

1. Victim navigates to a fraudulent GitHub repository (e.g., github.com/LastPass-Authenticator) and downloads a malicious ZIP archive.
2. The archive is opened, exposing vsdbg.exe and a malicious vsdbg.dll, initiating a DLL side-loading sequence.
3. The loader executes multiple privilege escalation techniques to achieve SYSTEM-level access.
4. The installer deploys the kernel driver (e.g., nvfsflt64.sys) as a Windows service named 'NvFsFilter'.
5. The driver (Alinubx.sys/CcProtect.sys) loads into the kernel and parses an internal list of 145 security-related processes to terminate.
6. The 'Rapuncel' stealer extracts saved passwords from browser app-bound data and harvests session files for Discord, Steam, and Telegram.
7. Harvested data is compressed into a ZIP file and exfiltrated to an attacker-controlled command-and-control server.

Impact

Victims experience full credential compromise including saved web passwords, cryptocurrency wallet seeds, and active session tokens for critical communication tools. Because the malware operates at the kernel level and proactively terminates security software, traditional detection and remediation tools are bypassed, necessitating a full system rebuild for infected machines.

Recommendation

Prioritize the following actions for detection engineering and incident response:

• Deploy the Sigma rule below to detect the installation of the specific kernel driver service.
• Audit existing endpoints for the existence of the file C:\Windows\System32\drivers\nvfsflt64.sys.
• Monitor process creation logs for the execution of vsdbg.exe in suspicious working directories (non-standard paths).
• Enforce the use of Microsoft's vulnerable driver blocklist via Windows Defender Application Control (WDAC).
• Implement memory forensic analysis on hosts suspected of infection to identify the presence of the driver if standard EDR is disabled.