Abuse of Microsoft-Signed Drivers in Fake LastPass Lures Highlights BYOVD Threat to EDR Defenses

Security researchers at LastPass and Delphos Labs uncovered an active campaign delivering credential-stealing malware via fraudulent GitHub repositories mimicking the official LastPass Authenticator application. The attackers used search engine optimization (SEO) poisoning to drive users seeking authenticator downloads to malicious repositories hosting large ZIP archives. Within the archive, threat actors leveraged DLL side-loading against a renamed Microsoft debugging executable (vsdbg.exe) to elevate privileges to SYSTEM. Once privileged execution was achieved, the malware installed and registered a validly signed Microsoft Hardware Compatibility Program kernel driver configured to terminate antivirus and EDR processes before exfiltrating browser data, system credentials, and session tokens. This incident illustrates a critical vulnerability in the endpoint trust model that impacts systems engineers, DevOps teams, and corporate IT administrators alike. By deploying a kernel-level driver signed through Microsoft's official hardware verification pipeline, the malware bypassed standard Windows driver signature enforcement and operating system integrity protections. Because the rogue driver possessed ring-0 execution privileges, it neutralized commercial endpoint security agents without triggering initial detection heuristics. Any engineer or employee operating on an infected workstation risks having local credential stores, API tokens, Discord/Steam tokens, and active browser sessions compromised before security telemetry can register the incident. Kernel-level defense evasion represents an accelerating trend in modern cyber attacks. Known as Bring Your Own Vulnerable Driver (BYOVD) or abused driver deployment, attackers increasingly utilize legitimate code-signing ecosystems and system debugging tools to subvert modern behavioral EDR solutions. Rather than attempting to bypass endpoint agents in user space (ring-3), adversaries move deeper into the kernel stack where security software itself operates. Furthermore, housing distribution artifacts on reputable developer ecosystems like GitHub exploits organizational trust in software repository hosting, blending malicious downloads into daily developer workflows. In practice, security operations and systems engineering teams must adopt aggressive driver blocklists and implement Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI) policies. Organizations should enforce centralized software provisioning mechanisms, prohibiting unmanaged binary execution directly from public repositories. Security leaders must also ensure that credential rotation protocols are immediately invoked if an endpoint compromise is suspected, as modern stealers harvest secrets prior to terminating endpoint telemetry, leaving persistent kernel services intact across system reboots.