A Signed Driver Just Killed 145 Security Tools. Stop Trusting the Signature.

LastPass disclosed a campaign on 17 September involving a fake Authenticator installer. The infostealer at the end of it isn’t the most interesting part. The real damage came from an EDR killer driver that carried a genuine Microsoft signature. It still evaded Microsoft’s own blocklist. If your security plan treats a valid signature as proof of safety, this case is the argument for changing it.

The EDR killer driver’s signature did exactly what it was designed to do

Code signing exists to answer one question: did this file come from who it claims to, unmodified? The driver behind this campaign, Alinubx.sys, passed that test cleanly. It carried a legitimate chain through the Windows Hardware Compatibility Publisher programme. Windows loaded it without complaint. That’s precisely what a valid signature is supposed to achieve.

The loader that delivered it was no less polished. It arrived through a search-optimised fake GitHub page. The archive was padded to 148MB, specifically to dodge scanners that skip oversized files. Inside was a copy of Microsoft’s own vsdbg.exe debugger, renamed, and set up to sideload its payload without a prompt. Every step was built to look ordinary. That’s the point. This wasn’t a crude attempt that got lucky. It was engineered around the assumption that signatures and familiar filenames would do the convincing for it.

The trouble is that “signed” was never meant to mean “safe”, only “verified”. Somewhere between the security industry and its customers, that distinction got lost. A signed driver can still be a repurposed disk-encryption component from an unrelated Chinese software vendor. This one was renamed to look like an NVIDIA filter. It was loaded specifically to kill a hundred and forty-five rival security products at once. Nothing about a valid signature rules that out.

The blocklist model is reactive by design, and that’s the real gap

Microsoft’s vulnerable driver blocklist works from known file hashes. Delphos reported the driver on 19 August. Microsoft judged it didn’t meet its definition of a vulnerability, since the component wasn’t Microsoft’s own. It pointed the researchers to a separate blocklist channel instead. A month later, when LastPass went public, it still wasn’t blocked. Rename the file and the hash changes anyway, so even a fast-moving blocklist would only ever be catching up.

That’s not really a Microsoft failing so much as a structural one. Any list built from known-bad hashes will always trail behind attackers who can simply recompile or rename their tools. Waiting for a vendor blocklist to catch a specific driver means waiting for yesterday’s threat to get fixed. Today’s variant is already live.

What businesses should actually take from this

Stop treating antivirus and EDR as a fixed floor that can’t be removed. This EDR killer driver assumes your endpoint protection can be switched off from underneath. It builds the rest of the attack on that assumption holding, just like the ransomware-affiliate EDR killer kits that came before it. Does your incident response plan have an answer for “what if the EDR agent simply isn’t running”? Close that gap before the next disclosure, not after it.

The practical fix isn’t more antivirus. It’s fewer paths for an unverified installer to reach a company laptop in the first place. Software should come from an approved catalogue or a managed deployment tool. Never a search result and a download button, however convincing the page behind it looks. Standing local admin rights should be the exception, not the default, since this driver needed elevated privileges to install itself. Kernel driver installations outside a known change window deserve a second look too, signed or not.

None of that is a new idea. What’s new is a fresh, concrete reason why the old advice about verified downloads and least privilege still holds. Even when the attacker has a Microsoft signature. Even with forty other brands to impersonate.

Scale is the other warning sign worth taking seriously

This wasn’t a bespoke tool aimed at one password manager. LastPass and Delphos found the same kit, the same driver and the same loader, wrapped around at least forty other brands. A second fake page, targeting macOS users, was found and removed during the investigation. The researchers said plainly that the infrastructure shows every sign of returning once this version is burned.

Whatever brand gets impersonated next, the underlying EDR killer driver and the trust it exploits will likely look identical. That’s exactly why the fix belongs at the level of “how software reaches our machines”, not “block this one file hash”. Treating this as a LastPass story, rather than a software-supply story, is the mistake worth avoiding. The name on the installer changes. The EDR killer driver behind it does not.