Fake LastPass Authenticator Installer Uses Microsoft‑Signed Driver to Kill Antivirus and Steal Crypto
A fake LastPass Authenticator download is abusing a Microsoft‑signed kernel driver to shut down antivirus and endpoint tools before raiding browser passwords, crypto wallets, and popular app sessions, exposing how attackers can turn trusted signatures against users.
Attackers are exploiting one of Windows’ strongest trust signals to sneak past defenses and loot users’ accounts.
Security researchers have detailed a malicious LastPass Authenticator installer that uses a Microsoft‑signed kernel driver to disable antivirus and endpoint detection and response (EDR) products. Once those protections are out of the way, the payload steals browser‑stored passwords, cryptocurrency wallet files, and active sessions for Discord, Steam and Telegram, according to a technical report highlighted by The Hacker News.
The abuse of a legitimately signed Windows kernel driver is what makes this campaign stand out. Kernel‑level code sits at the core of the operating system. When it carries a valid Microsoft signature, Windows treats it as trusted, allowing it to perform actions that ordinary software can’t easily block. Here, that trust is being used to turn off or blind the very tools meant to catch malware.
The installer itself masquerades as a LastPass Authenticator download. People who believe they are adding a second factor of protection end up launching a program built to harvest the secrets they were trying to secure. Stolen browser credentials and wallet files can give attackers direct access to online accounts and crypto holdings, while hijacked sessions for Discord, Steam and Telegram can be abused to spread the malware further or pivot into other communities.
For individuals, the impact can be immediate: emptied wallets, compromised accounts and the realization that the compromise came from what looked like a security app. For smaller organizations that rely on consumer password managers and messaging apps inside their workflows, one employee running the fake installer can open a path deeper into internal systems.
At a broader level, the campaign undercuts confidence in code signing, a cornerstone of modern software trust. Signatures are supposed to confirm that code comes from a vetted source and hasn’t been altered. When attackers manage to deploy or repurpose a signed driver in support of malware, defenders end up trying to distinguish between hostile and benign components that all appear, on the surface, to be approved.
The Hacker News article breaks down how the abused signed driver is being trusted in this case, pointing to gaps that can be exploited when older or vulnerable drivers retain their trusted status. That has implications far beyond this one fake app, especially if well‑resourced criminal groups or state‑linked actors adopt similar techniques.
The key steps to watch now are how quickly Microsoft moves to block or revoke the driver being misused, and whether password managers, browser vendors and messaging platforms introduce clearer warnings about fake installers. Investigators will also be watching for copycat operations that target other widely used security tools, crypto utilities or enterprise software using the same kind of signed‑driver loophole.
Sources
- OSINT