A malicious GitHub repository masquerading as a source for the LastPass Authenticator has been found distributing a installer that wields a Microsoft-signed driver to cripple security defenses before deploying password-stealing malware. Disclosed by researchers from LastPass and Delphos Labs on September 17, the campaign illustrates a potent attack chain that weaponizes trust in both developer platforms and core operating system validation frameworks.
The attack initiates with social engineering: a fake repository impersonates the official LastPass application download. When a user runs the installer, it executes a precise sequence designed for stealth. First, it loads a kernel-level driver—software operating with the highest system privileges—to forcefully terminate antivirus and Endpoint Detection and Response (EDR) solutions.
The driver's power comes from its legitimate signature. It is certified under Microsoft’s Windows Hardware Compatibility Program (WHCP), a process that validates hardware and driver compatibility, not intent. Attackers exploited this critical gap, using the signature to gain initial trust from the OS and security tools. This allowed the driver to operate undetected, registering zero detections on VirusTotal at the time of analysis and demonstrating a blind spot for signature-based security.
With protections neutered, the installer then deploys its primary payload: a credential stealer. The operation blends low-effort tactics, like typosquatting on a trusted platform, with advanced kernel-level evasion, creating a highly effective threat with a low barrier to entry.
This incident reframes GitHub as a high-value attack surface. The platform's inherent trust can lead to reduced scrutiny from both users and automated tools, making it an effective malware distribution channel. While the malicious repository has been flagged for removal, researchers warn that mirror copies may persist, highlighting ongoing challenges with takedown efficacy.
For defenders, the attack underscores the need for a proactive, layered security posture. Recommendations from experts include strictly verifying software provenance, even from established platforms; implementing tight controls on kernel-mode driver loading, potentially leveraging Microsoft's driver blocklist initiatives; and bolstering user education on download risks.
The abuse of a trusted, signed driver to bypass security at the kernel level reveals a systemic vulnerability in the Windows trust model. As adversaries refine these supply-chain techniques, the security community must pivot towards enhanced monitoring and hardened configurations to mitigate these sophisticated threats.
一個偽裝為LastPass Authenticator來源的惡意GitHub儲存庫被發現分發一個安裝程式，該安裝程式利用一個微軟簽署的驅動程式，在部署密碼竊取惡意軟件之前先癱瘓安全防禦。此攻擊活動由LastPass與Delphos Labs的研究人員於9月17日披露，展示了一條強大的攻擊鏈，它武器化了對開發者平台及核心作業系統驗證框架的信任。
攻擊始於社會工程學：一個假冒的儲存庫冒充官方LastPass應用程式下載頁面。當用戶運行安裝程式時，它會執行一系列旨在隱蔽的精確操作。首先，它載入一個核心層級驅動程式——這是在最高系統權限下運作的軟件——用於強制終止防毒軟體及端點偵測與回應解決方案。
該驅動程式的力量來自其合法簽名。它是根據微軟的Windows硬體相容性計畫認證的，該計畫驗證的是硬體與驅動程式的相容性，而非意圖。攻擊者利用了這一關鍵缺口，使用該簽名從作業系統和安全工具獲得初始信任。這使得驅動程式能夠不被偵測地運作，在分析時於VirusTotal上錄得零偵測記錄，並暴露了基於簽名的安全方案的盲點。
隨著防護被中和，安裝程式隨後部署其主要酬載：一個憑證竊取器。此次行動結合了低成本策略（例如在可信任平台上進行品牌仿冒）與先進的核心層級規避技術，創造出一個入門門檻低但極具威脅性的攻擊工具。
此事件重新定義了GitHub作為一個高價值攻擊面。平台與生俱來的信任可能導致用戶和自動化工具的審查減少，使其成為有效的惡意軟件分發渠道。雖然該惡意儲存庫已被標記刪除，但研究人員警告鏡像副本可能依然存在，凸顯了下架有效性的持續挑戰。
對於防禦者而言，此攻擊強調了採取主動、分層安全措施的必要性。專家的建議包括：嚴格驗證軟件來源，即使來自知名平台；對核心模式驅動程式的載入實施嚴格控制，或可利用微軟的驅動程式封鎖清單倡議；並加強用戶對下載風險的教育。
濫用受信任且已簽署的驅動程式以在核心層級繞過安全防護，揭示了Windows信任模型中的一個系統性漏洞。隨著對手完善這些供應鏈攻擊技術，安全社群必須轉向加強監控與強化配置，以緩解這些複雜的威脅。