Affected Systems

Windows systems where users downloaded a fake LastPass Authenticator installer from a malicious GitHub repository (github.com/LastPass-Authenticator). The attack uses a Microsoft-signed kernel driver (Alinubx.sys, renamed CcProtect.sys from CnCrypt disk encryption software) signed March 2023. Affects all Windows versions; driver not blocked by Microsoft's vulnerable driver blocklist as of September 17, 2026. No LastPass infrastructure or customer vaults compromised.

Exploitation Status

Active exploitation confirmed. Malicious GitHub repository actively serving fake installers (148 MB and 127.9 MB ZIP files). Driver achieved zero detections on VirusTotal in August 2026. Public proof-of-concept code exists for the underlying CcProtect.sys driver, already cataloged on LOLDrivers. Microsoft declined to classify as security vulnerability on August 19, 2026, stating driver is not a Microsoft component.

Business Impact

Kernel-level compromise that terminates 145 antivirus and EDR products from kernel space, rendering endpoint security controls ineffective. Stealer exfiltrates saved passwords from 24+ browsers (including Chrome/Edge via app-bound encryption bypass), cryptocurrency wallets, Discord/Steam/Telegram sessions, Windows Credential Manager contents, and files matching "password," "seed," or "recovery." Driver persists across reboots and continuously re-kills security tools, preventing automated remediation. Legitimate Microsoft signature allows driver to load on systems with default protections. Organizations using LastPass branding face reputational confusion, though LastPass infrastructure unaffected.

Urgency

🔴 Immediate

Recommended Actions

  • Block driver hash and service indicators immediately: service name NvFsFilter, file path C:\Windows\System32\drivers\nvfsflt64.sys, device path \\.\Alinubx, and drivers signed by Henan Dafeng Software or containing 'CnCrypt' in signing details
  • Hunt for compromised endpoints by searching EDM/SIEM logs for service creation events matching NvFsFilter, driver loads from nvfsflt64.sys, or mass termination of security processes following driver load events
  • Block access to github.com/LastPass-Authenticator and scan web proxy logs for downloads of 127-148 MB ZIP files from non-corporate GitHub repositories
  • Force password resets from clean devices for any user who may have downloaded software from GitHub in the past 30 days, prioritizing accounts with access to cryptocurrency wallets, privileged credentials, or stored in Windows Credential Manager
  • Perform kernel-level forensic analysis or reimage any system where indicators are found; standard EDR remediation will fail due to kernel-level persistence and continuous security tool termination