Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR

Researchers at LastPass and Delphos Labs discovered a fake LastPass Authenticator installer on GitHub that installs a malicious Windows kernel driver. This driver is signed by Microsoft's hardware-compatibility program, which allows it to evade detection. The driver shuts down antivirus and other security software, enabling a password stealer to run undetected. When tested, the driver had zero detections on VirusTotal, indicating its ability to bypass security measures. The installer was found to be capable of disabling security software, allowing the password stealer to operate without interference.