Hackers Use Microsoft-Signed Driver to Disable 145 Security Tools and Steal Passwords

Researchers uncovered a malware campaign that used a Microsoft-attested Windows kernel driver to turn off 145 antivirus and endpoint security processes, then stole passwords, cryptocurrency wallet data, browser sessions, and other sensitive information. LastPass Threat Intelligence, Mitigation, and Escalation team, working with Delphos Labs, discovered the operation after attackers impersonated LastPass Authenticator through fraudulent GitHub pages. The researchers track the information-stealing malware as Rapuncel. The campaign did not compromise LastPass systems, services, or customer vaults. Instead, attackers abused the LastPass name to make fake download pages appear legitimate in search results. Victims searching for...

Read the full article at the source.