As cited
Copy frozen at (site build).
threat intel
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR
A malicious installer masquerading as the LastPass Authenticator and hosted on GitHub delivers a Windows kernel driver signed by Microsoft's hardware-compatibility program. The driver disables antivirus and endpoint detection and response (EDR) software, allowing a password stealer payload to execute undetected.
Why it matters: Organizations and individuals using or managing LastPass deployments face immediate risk from supply chain impersonation; the Microsoft-signed driver represents a significant evasion technique that bypasses common defenses.
- Source published
- First seen by Cybersecurity Tracker