LastPass impersonation campaign uses kernel driver to disable security tools

A sophisticated impersonation campaign is using fake LastPass Authenticator installers to distribute infostealer malware known as ‘Rapuncel’. Researchers from LastPass and Delphos Labs discovered that attackers used SEO optimization to ensure fraudulent GitHub pages appeared at the top of search results for the legitimate application.

The attack utilizes a technique called DLL side-loading. Victims download a large ZIP file containing a renamed Microsoft debugging tool and a malicious DLL. Once executed, the installer attempts to gain SYSTEM-level privileges to install a kernel driver named ‘Alinubx.sys’. This driver, which was signed by Microsoft’s hardware-compatibility program, is designed to terminate 145 different antivirus and endpoint detection and response (EDR) security tools.

By operating at the kernel level, the driver can shut down security software before the malware executes, making the intrusion difficult for user-mode tools to detect or block. LastPass has confirmed that its internal systems, services, and customer vaults were not compromised; the attackers merely used the brand name to lure victims.