Fake LastPass Authenticator Installer with Signed BYOVD Driver and Credential Stealer
First seen Sep 22, 2026 · Updated Sep 22, 2026
Threat actors distributed a fake LastPass Authenticator installer via GitHub that deploys a Microsoft-signed kernel driver to disable antivirus and EDR protections before executing a password stealer. The driver's legitimate Microsoft signature and zero VirusTotal detections at time of discovery allow it to bypass most endpoint security controls undetected.
Technical Analysis
The attack uses a Bring Your Own Vulnerable Driver (BYOVD) technique where a kernel-mode driver, signed through Microsoft's legitimate hardware-compatibility program, is abused to terminate antivirus and EDR processes with kernel-level privileges, circumventing user-mode protections. Once security software is disabled, a credential-stealing payload executes to harvest stored passwords and authentication data, likely targeting password manager vaults, browser-stored credentials, and session tokens. The abuse of a trusted Microsoft signature is significant because it allows the driver to load without triggering typical code-signing or driver-blocklist defenses, and the zero-detection rate on VirusTotal indicates strong evasion against current AV/EDR heuristics. Distribution via GitHub, a platform widely trusted by developers and automated tooling, increases the risk of accidental installation by users or CI/CD pipelines searching for legitimate authenticator utilities. Organizations running AI agents or automated developer tooling that fetch installers or dependencies from GitHub repositories are at risk of credential exfiltration, including API keys, cloud credentials, and LLM service tokens, which could then be used to compromise downstream agent-connected systems and pipelines.
Affected Systems
Windows systems (all supported versions with kernel driver loading enabled); systems where users download and execute unverified installers from GitHub; environments using LastPass or LastPass Authenticator where users may search for related tools
Indicators of Compromise
- Fake LastPass Authenticator installer (filename/hash not disclosed in source reporting)
- Microsoft-signed malicious kernel driver (specific hash/name not disclosed)
- GitHub repository hosting the fake installer (specific repo URL not disclosed in available data)
Remediation Steps
- 1
Verify software sources
Only download LastPass Authenticator and related security tools directly from official LastPass domains or verified app stores, never from third-party GitHub repositories or unofficial mirrors.
- 2
Implement driver blocklisting
Deploy Microsoft's vulnerable driver blocklist (HVCI/WDAC policies) and keep it updated to prevent known-abused signed drivers from loading, even when validly signed.
- 3
Restrict kernel driver loading
Enforce Windows Defender Application Control (WDAC) or similar policies to restrict which drivers can load, and monitor for unexpected kernel driver installation events.
- 4
Monitor EDR/AV tamper events
Configure security tooling to alert on unexpected termination or disabling of AV/EDR processes, which is a strong indicator of BYOVD attacks in progress.
- 5
Rotate exposed credentials
If the fake installer was executed in your environment, immediately rotate all stored passwords, API keys, and session tokens, including any credentials used by AI agents, automation scripts, or CI/CD pipelines.
- 6
Audit GitHub-sourced dependencies
Review internal policies for downloading tools and installers from GitHub, especially in developer and automation environments, and implement code-signing and reputation checks before execution.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.