{"id":244325,"date":"2026-09-21T21:29:00","date_gmt":"2026-09-22T02:29:00","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr"},"modified":"2026-09-21T21:29:00","modified_gmt":"2026-09-22T02:29:00","slug":"fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr","title":{"rendered":"Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-antivirus-and-edr2.jpg\"><\/a><\/p>\n<p>A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17.<\/p>\n<p>Microsoft\u2019s own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers checked it in August, and was not on Microsoft\u2019s list of blocked drivers. LastPass says none of its own systems, services, or customer vaults were touched, and that the attackers only borrowed its name.<\/p>\n<p>The lure is a fake GitHub page <a href=\"http:\/\/(github.com\/LastPass-Authenticator\">(github.com\/LastPass-Authenticator<\/a>) that ranks in search results for terms like \u201cLastPass Authenticator download\u201d and looks like a real LastPass product page.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft\u2019s own hardware-compatibility program signs the driver, scored zero detections on VirusTotal [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-244325","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244325"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244325\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}