[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAqr0g7LCBzA3JWA4oBVkHbEaOSa-usEQmELjQ83H5Aw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"0a787350-d91c-48e9-9fe7-1760ea80f3bb","fake-lastpass-installer-uses-microsoft-signed-driver-to-blind-security-tools","52e4796a-b262-4ad5-a1ad-66fa1a0fa83a","Fake LastPass Installer Uses Microsoft-Signed Driver to Blind Security Tools","Attackers created a convincing fake GitHub repository impersonating LastPass to distribute a malicious installer that weaponizes a legitimate Microsoft-signed kernel driver to disable antivirus and EDR solutions before stealing credentials. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), is particularly dangerous because it exploits the implicit trust operating systems place in signed drivers, allowing malware to operate at the kernel level where security tools cannot defend themselves. The attack chain highlights how social engineering and software supply chain abuse can combine to defeat even robust endpoint defenses. Organizations relying solely on endpoint security tools are left blind when those tools can be surgically disabled before the payload executes.","**Immediate actions:**\n- Audit and block known vulnerable signed drivers using Microsoft's recommended driver blocklist (DriverSiPolicy.xml) and enforce it via Windows Defender Application Control (WDAC).\n- Train users to verify software downloads only from official vendor websites and to scrutinize GitHub repositories for legitimacy indicators (stars, commit history, verified publisher).\n- Enable multi-factor authentication on all password manager and sensitive accounts to limit credential-theft impact.\n\n**Long-term improvements:**\n- Implement a software allowlisting policy to prevent unauthorized executables and drivers from running in your environment.\n- Establish a formal third-party software vetting process that validates authenticity and integrity of all downloads before deployment.\n- Adopt a defense-in-depth architecture so that disabling one security layer does not expose the entire environment to compromise.\n\n**Detection measures:**\n- Deploy kernel-level telemetry and memory integrity monitoring (e.g., Microsoft Vulnerable Driver Blocklist, Sysmon with driver-load rules) to alert on suspicious driver installations.\n- Monitor for anomalous process terminations targeting security products, which can serve as an early indicator of BYOVD attacks.\n- Integrate threat intelligence feeds that track known BYOVD driver hashes and automatically push blocklist updates to endpoints.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality (application allowlisting)","NIST CSF PR.AT-1: Awareness and Training","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1195: Supply Chain Compromise","Microsoft WDAC Vulnerable Driver Blocklist Policy",{},"published","2026-09-21T20:20:50.899718+00:00","2026-09-21T20:20:50.032+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ffake-lastpass-authenticator-installer.html","fake-lastpass-authenticator-installer-abuses-microsoft-signed-driver-to-kill-ant-f2aa6f","Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"e5e752e4-9ee9-4b24-979e-435c24ee7ac2","2026-09-22","morning","ThreatNoir Morning Brief — September 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-22\u002Fthreatnoir-morning-brief-2026-09-22.mp3",[58,62,66],{"slug":59,"name":60,"problem":61},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":67,"name":68,"problem":69},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]