LastPass traced a fake Authenticator hosted on GitHub to a months-long impersonation campaign that spoofed at least 40 organizations, including its own brand. The server steering victims to the download was still being updated in September.
Perspective Coverage
4 publishers
- Builder
- Builder 27%
- Operator
- Operator 64%
- Investor
- Investor 9%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence70
A Microsoft-attested driver terminated 145 antivirus processes from kernel mode
LastPass and Delphos Labs say a single malware-as-a-service kit impersonated at least 40 companies on GitHub, and the kernel driver it delivered was Microsoft-attested and undetected by every engine on VirusTotal.
Publishers:blog.lastpass.com
Reality
- Evidence62
- Adoption48
- Hype gap+12
- Incentives68
- Confidence55
buildOne report1 publisher A Microsoft-signed driver in a fake LastPass installer kills 145 security processes from the kernel
Alinubx.sys terminates security agents from kernel mode under a Microsoft Windows Hardware Compatibility Publisher signature dated March 2023, and nothing in the driver has to be exploited for that to work.
Reality
- Evidence62
- Adoption40
- Hype gap+8
- Incentives55
- Confidence55
buildOne report1 publisher A Microsoft-signed driver in a fake GitHub download kills 145 security process names from kernel mode
LastPass TIME and Delphos Labs analysed a malware-as-a-service kit that arrives as a padded ZIP from an SEO-boosted fake repository and ends with a signed driver terminating security processes from kernel mode.
Reality
- Evidence45
- Adoption30
- Hype gap+12
- Incentives55
- Confidence40
A Microsoft-signed driver in fake LastPass GitHub repos kills 145 security products
LastPass and Delphos Labs traced SEO-tuned GitHub repositories impersonating at least 40 software brands to a new stealer called Rapuncel, shipped alongside a signed kernel driver that opens protected security processes as kernel code and terminates them.
Reality
- Evidence58
- Adoption30
- Hype gap+15
- Incentives62
- Confidence57