Researchers found attackers impersonating LastPass with a fake GitHub “LastPass Authenticator” download page that tricks people into downloading a large ZIP and running a fake installer. The installer uses a Microsoft-signed Windows driver to shut down antivirus/EDR tools, then runs a password stealer that exfiltrates saved browser passwords, wallet files, and app sessions.
This campaign relied on a fake GitHub page built to look like an official LastPass Authenticator product listing. The page was optimized to appear in search results for terms like "LastPass Authenticator download," a classic search engine lure that catches users who search for software rather than navigating directly to the vendor's site. Clicking the download button routed victims through several GitHub pages before landing on an attacker-controlled server that served a large ZIP file, padded with junk data so it would slip past scanners with size limits.
Inside the ZIP was a renamed copy of a real Microsoft debugging tool, vsdbg.exe, placed next to a malicious file named vsdbg.dll. Running the fake installer triggered DLL side-loading, allowing the attacker's code to execute under the guise of a legitimate Microsoft tool. From there, the installer attempted to gain administrator or SYSTEM privileges and installed a kernel driver as a service.
The kernel driver, named by researchers as Alinubx.sys, was signed through Microsoft's hardware compatibility program, giving it the appearance of trustworthiness. Because the driver operates below the level where antivirus and EDR tools run, it was able to work through a list of 145 security process names and terminate each one it found running. With defenses disabled, an infostealer then harvested browser-saved passwords, crypto wallet files, session data for apps like Discord, Steam, and Telegram, and Windows Credential Manager contents.
The attacker infrastructure reportedly hosted impersonation pages for at least 40 brands, suggesting this fake LastPass page was one instance of a broader, repeatable download-impersonation pattern rather than an isolated one-off lure.
Organizations should reinforce that authentication and security apps, including tools like LastPass Authenticator, should only be downloaded from official vendor sites or official app stores, never from a GitHub search result. IT and security teams should plan for scenarios where AV or EDR tools appear to stop working unexpectedly, since attackers can use signed drivers to disable them before stealing data. If a user has already run a suspicious installer, treat every password saved in the browser on that machine as compromised: change those passwords from a separate, clean device and review account activity for anything unusual.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They created a fake GitHub page at github.com/LastPass-Authenticator that ranks in search results for terms like LastPass Authenticator download and looks like a real product page, then redirected visitors through several GitHub pages to an attacker server serving a large ZIP file.
The installer side-loads a malicious DLL via a renamed Microsoft debugging tool, elevates privileges, and installs a Microsoft-signed kernel driver named Alinubx.sys that carries a list of 145 antivirus and security process names and terminates each one it finds running.
Treat every password saved in the browser on that machine as stolen, change those passwords from a separate, clean device, and review account activity for anything unusual.
It steals browser-saved passwords, crypto wallet files, session data for apps like Discord, Steam, and Telegram, and Windows Credential Manager contents.
You Google “LastPass Authenticator download” and see a GitHub link that looks totally legit. That’s the trap. You click it, land on a fake GitHub “LastPass Authenticator” page, hit Download, bounce through several GitHub pages, and end up with a huge 140‑meg ZIP on your desktop. You unzip and run the installer, vsdbg.exe next to vsdbg.dll. Behind the scenes it uses DLL side-loading, a Microsoft-signed driver called Alinubx.sys kills your antivirus, then a stealer quietly grabs every saved browser password, wallet file, and app session. Here’s the move: if you ever need LastPass or any authenticator, skip search results. Go straight to the vendor’s official site or app store and download only from there.
Attackers used fake “LastPass Authenticator” and fake macOS LastPass pages on GitHub to trick people into downloading a malicious installer. The campaign relied on SEO so the fraudulent GitHub page appeared near the top of search results, then redirected victims through multiple pages to a download…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
