Microsoft‑Signed Driver Disables Antivirus in Fake LastPass Stealer

A new variant of the LastPass authenticator installer was found on GitHub. The installer installs a Windows kernel driver that immediately disables antivirus and other security software before launching a password‑stealing payload¹.

The driver is digitally signed with a certificate issued through Microsoft's Hardware Compatibility Program. Because of this signature, the malicious code can load with elevated privileges without triggering typical user awareness checks or standard AV heuristics. When tested against VirusTotal, the installer scored zero detections, underscoring how trusted signatures can be abused when combined with sophisticated persistence techniques¹.

Experts say leveraging a legitimate Microsoft signing authority is especially concerning because it exploits the trust users place in certified drivers. Similar tactics were seen in 2017 when Bad Rabbit ransomware used Kaspersky certificates (CVE‑2018–6943) to sign its loader. This pattern shows a broader trend among threat actors piggybacking on reputable certification programs to bypass defenses and increase installation success rates.

Researchers also point out that the same group behind the Contagious Interview campaign—a North Korean APT that compromised over 30 000 devices worldwide—has previously targeted web designers, engineers, and cryptocurrency specialists. The new stealer could represent an extension of those efforts, aiming to harvest credentials from individuals who are already high‑value targets due to their roles in digital asset management¹.

For end users, the key takeaway is that even seemingly trustworthy platforms like GitHub can host malicious code signed by major vendors. Security professionals advise verifying download sources directly from official vendor sites whenever possible, rather than relying solely on third‑party repositories or community mirrors.¹