Fake LastPass Authenticator Installer Uses Signed Kernel Driver to Blind AV/EDR Before Deploying Stealer

Researchers at LastPass and Delphos Labs reported on September 17, 2026 that a fake LastPass Authenticator installer distributed via GitHub drops a Windows kernel driver designed to disable antivirus and EDR software prior to executing a password stealer. Notably, the driver is signed through Microsoft's own hardware-compatibility program and reportedly scored zero detections on VirusTotal at the time researchers examined it.

Why It Matters

This campaign combines two dangerous elements: social-engineering abuse of a trusted brand (LastPass Authenticator) and a legitimately signed kernel driver used to neutralize endpoint defenses. A Microsoft-signed driver carries inherent trust in the Windows driver-loading model, meaning it can bypass Driver Signature Enforcement and evade many detections that rely on unsigned-driver heuristics. Any organization or individual that installs security tools from unofficial sources (GitHub releases impersonating vendors, rather than official app stores or vendor sites) is at risk. Because AV/EDR is disabled before the stealer runs, victims may have no real-time alerting during the credential-theft stage.

What Defenders Should Watch For

• Monitor for installation of unexpected or unrecognized kernel drivers, especially those loaded shortly before AV/EDR services stop, crash, or are unloaded unexpectedly.
• Hunt for termination or tampering events against security-product services and processes (service stop, driver unload, process kill) that are not initiated by admin/IT tooling.
• Review software-supply channels: flag installers for security/authenticator apps sourced from GitHub releases or third-party mirrors rather than official vendor domains.
• Where possible, maintain a driver allowlist/blocklist policy (e.g., Microsoft's vulnerable/malicious driver blocklist, HVCI) and ensure it is kept current, since this abuse relies on a signed-but-malicious driver rather than an unsigned one.
• Educate users that legitimate LastPass Authenticator installers come only from LastPass's official site or verified app stores — never from third-party GitHub repos.

This is a developing story based on initial reporting from LastPass and Delphos Labs; further technical details (specific driver name/hash, C2 infrastructure, full stealer capabilities) had not been fully disclosed at time of writing. We will update or publish detection content as more indicators become available. Read the original report at The Hacker News.