A fake LastPass Authenticator installer distributed via GitHub installs a Microsoft-signed Windows kernel driver that disables antivirus and endpoint detection and response products before deploying a password stealer, according to a disclosure published by LastPass and Delphos Labs on September 17, 2026.
The driver was signed through Microsoft’s Windows Hardware Compatibility Program, allowing it to evade security controls. When researchers first analyzed the malicious driver, it scored zero detections on VirusTotal. The campaign abuses legitimate Microsoft signing processes to achieve kernel-level security product bypass before stealing credentials.
Fake LastPass Authenticator Distributed via GitHub
The malicious installer was distributed through GitHub, masquerading as the official LastPass Authenticator application. Users searching for LastPass Authenticator tools or following malicious links could download the fake installer, believing it to be a legitimate LastPass product.
GitHub’s platform allows any user to create repositories and host downloadable files, making it a common distribution channel for malware campaigns that impersonate legitimate software. Attackers create repository names and file names that mimic official products, relying on user trust in the brand and the GitHub platform.
Microsoft-Signed Kernel Driver Disables Antivirus and EDR Products
The fake installer deploys a Windows kernel driver that has been signed by Microsoft through the Windows Hardware Compatibility Program. The driver’s legitimate signature allows it to load into the Windows kernel without triggering warnings from Driver Signature Enforcement, a Windows security feature that blocks unsigned or untrusted drivers.
Once loaded, the driver disables antivirus and EDR products running on the system. Kernel-level drivers operate at the highest privilege level in Windows, granting them the capability to terminate security processes, unload security drivers, or disable monitoring hooks that security products rely on.
By disabling security products before deploying the password stealer, the attacker ensures the credential-harvesting payload runs without detection. The malware can extract passwords from browsers, credential managers, and application memory without triggering alerts from the now-disabled security tools.
Zero Detections on VirusTotal When Initially Analyzed
When researchers first submitted the malicious driver to VirusTotal, it scored zero detections across all antivirus engines. The Microsoft signature and the driver’s evasion techniques prevented security tools from flagging it as malicious.
Zero-detection malware represents the highest tier of evasion. Attackers achieving this level of stealth can operate undetected across victim environments until security vendors update their signatures and heuristics to recognize the threat.
The driver’s zero-detection status also reflects the challenge of identifying malicious behavior in kernel-level code. Kernel drivers perform privileged operations that can appear suspicious but may also be legitimate system management tasks. Security tools must balance detecting malicious drivers against false positives that would flag legitimate hardware and system utilities.
LastPass and Delphos Labs Published Advisory September 17
LastPass and Delphos Labs disclosed the fake authenticator campaign on September 17, 2026. The advisory warned users to download LastPass tools only from official sources and described the driver-based EDR bypass technique.
The disclosure did not specify how many users downloaded the fake installer, how long the malicious GitHub repository remained online, or which specific antivirus and EDR products the driver targeted. The absence of victim metrics suggests early detection before widespread compromise, or a targeted campaign with limited distribution.
Abuse of Windows Hardware Compatibility Program Signing
The campaign’s success depends on abusing Microsoft’s Windows Hardware Compatibility Program, which provides driver signatures to hardware vendors and software developers who meet Microsoft’s requirements. Attackers obtained a legitimate signature by submitting the malicious driver to the program, either through a compromised developer account or by crafting the driver to pass Microsoft’s automated review.
Once signed, the driver is trusted by Windows as a legitimate Microsoft-approved component. This trust allows it to bypass Driver Signature Enforcement, load into the kernel, and disable security products—all without triggering warnings that would alert users to the malicious activity.
Microsoft should revoke the certificate used to sign the malicious driver, preventing it from loading on systems where the certificate revocation list is current. However, systems that do not check revocation lists or lack internet connectivity may continue to accept the signed driver even after revocation.
Implications for Signed Driver Abuse and Kernel-Level Evasion
The fake LastPass Authenticator campaign demonstrates that legitimate code signing is not a guarantee of trustworthiness. Attackers who obtain valid certificates—through compromise, fraud, or social engineering—can sign malware that security tools will trust.
Kernel-level malware with valid signatures represents one of the most difficult threats to detect and block. Security products running in user mode cannot prevent a signed kernel driver from loading, and once loaded, the driver can disable those same security products before they detect the payload.
Users Must Download Software Only from Official Sources
Users should download LastPass Authenticator and other security tools only from official vendor websites or trusted app stores. GitHub repositories, third-party download sites, and search engine results can host malicious impersonations that are difficult to distinguish from legitimate software.
Before installing any software, verify the source URL matches the vendor’s official domain, check the file’s digital signature after download, and review community feedback or security advisories for reports of fake installers targeting that product.
Organizations should implement application allowlisting to prevent unauthorized software installation, use endpoint detection and response tools that monitor kernel driver loading, and enforce policies requiring software downloads only from approved sources.
Microsoft Certificate Revocation and Driver Signing Policy
Microsoft should revoke the certificate used to sign the malicious driver and investigate how the attacker obtained a valid signature through the Windows Hardware Compatibility Program. Tightening review processes, increasing scrutiny of driver behavior, and implementing post-signing monitoring for abuse could reduce the risk of future malicious driver signing.
For defenders, the fake LastPass Authenticator incident underscores the need for defense-in-depth. Relying solely on antivirus or EDR creates a single point of failure when attackers can disable those tools with signed kernel drivers. Network monitoring, behavioral analytics, and application allowlisting provide additional detection layers that kernel-level malware cannot bypass as easily.
The campaign’s use of a legitimate platform (GitHub), a trusted brand (LastPass), and a valid Microsoft signature demonstrates how attackers layer evasion techniques to maximize stealth. Each element—fake branding, signed driver, zero-detection payload—exploits a different trust boundary, creating a composite attack that bypasses multiple defensive controls simultaneously.
