Fake LastPass Authenticator Installer Uses Microsoft‑Signed Driver to Disable Security Software

The Hacker News reported on 17 September that a counterfeit version of the LastPass Authenticator installer was being distributed via a public GitHub repository. The package masquerades as a legitimate two‑factor authentication tool but contains malicious code designed to compromise Windows systems.

When executed, the installer drops a kernel‑mode driver that has been signed through Microsoft’s hardware‑compatibility program. Because the driver carries a valid Microsoft signature, Windows accepts it without warning, allowing the malware to load at the system level.

Once the driver is active, it disables most antivirus products and endpoint detection and response (EDR) solutions, creating a window for a password‑stealing payload to run undetected. The driver itself registered zero detections on VirusTotal at the time of analysis, highlighting the challenges of identifying threats that leverage trusted signatures.

Australian IT professionals and students are advised to verify the provenance of any software before installation, especially tools related to credential management. Regularly updating security solutions, employing application whitelisting, and monitoring for unsigned driver activity are essential defenses against such supply‑chain attacks.

For those looking to deepen their defensive skill set, Wepro Technology offers CompTIA Security+ training, equipping participants with the knowledge to detect and mitigate advanced threats like the malicious driver used in this LastPass spoof.