What happened

Something sneaky showed up on GitHub pretending to be a LastPass Authenticator download page. Click the pretend download and you get a big ZIP from an attacker server that contains a renamed Microsoft debugging binary and a malicious DLL. When the benign-looking exe launches, Windows happily loads the DLL from the same folder — classic DLL side-loading — and the badness begins.

The loader escalates privileges (the researchers say it tries multiple methods and ends up at SYSTEM), installs a kernel-mode driver as a service, and then the driver proceeds to terminate antivirus and endpoint processes. The driver found in these incidents was labeled Alinubx.sys and carried a ready-made list of about 145 security-related process names to kill. Because the kill happens in the kernel, user-mode security tools don’t see it coming or stop it.

The ZIPs were stuffed with junk files to inflate size so some scanners that stop scanning after a threshold would skip the malicious parts. The driver itself comes from a known vulnerable driver lineage (a disk-encryption vendor’s driver), but here it was renamed and signed through the Windows hardware-signing pipeline — which made it appear legitimate to Windows while still being abusable. The attackers didn’t include every capability in the shipped driver, but what they did use was enough: the stealer grabbed saved browser passwords, cryptocurrency wallet files, session data for apps like Discord, Steam and Telegram, Windows Credential Manager contents, and any files named like “password,” “seed,” or “recovery.” For Chromium-based browsers the stealer injected into the browser process and asked the browser to decrypt stored credentials, then packaged everything up and exfiltrated it.

If you ran it — and how defenders can hunt

If you downloaded and ran the fake installer, assume anything stored on that machine is compromised: change passwords from a separate, clean device, consider your crypto wallets and saved sessions stolen, and review account activity. Because the driver persists at the kernel level and re-kills security tools on reboot, the infected system should be treated as a kernel-level compromise — ideally rebuilt or examined with kernel-level forensics if rebuilding isn’t possible.

For defenders hunting this family, look for behavior and lineage rather than a single filename (the operators will rename files). Useful indicators include:

  • Service: a service created as NvFsFilter
  • File: a driver written to C:\Windows\System32\drivers\nvfsflt64.sys
  • Signer: signing details referencing Henan Dafeng Software or CnCrypt
  • Device: the device path \\.\Alinubx
  • Behavior: a driver load immediately followed by security processes being terminated
  • Installer artifacts: a bundled vsdbg.exe sitting next to a vsdbg.dll in the same folder, or very large ZIPs padded with junk files

Note that vendor blocklists that match hashes can be evaded by renaming or recompiling drivers — the blocklist approach misses files that change their hashes. The signed hardware attestation chain can make a malicious or vulnerable driver look trustworthy to Windows even though it’s being misused.

Short, painful remediation checklist:

  1. Assume browser-stored passwords and wallets on the machine were exfiltrated.
  2. Use a different, clean device to change passwords and enable multi-factor authentication.
  3. Isolate the affected machine, collect logs, and consider a kernel-level forensic review or full rebuild.
  4. Hunt for the indicators above across your environment and block related infrastructure at the network edge.

Final thought: phishing for downloads still works because the packaging looks normal and Windows trusts signed drivers. Keep your guard up, and when in doubt, download authentic apps from the official vendor site or your OS app store — not from random repositories pretending to be trustworthy.