Fake LastPass Authenticator installer deploys signed driver to kill

🚨 ACTIVE EXPLOITATION

• Fake LastPass Authenticator installer on GitHub uses Microsoft-signed BYOVD driver to kill EDR
  A fake LastPass Authenticator installer on GitHub deploys a Microsoft-signed kernel driver that kills security software before a password stealer runs.
  • Targets Windows users searching for LastPass Authenticator downloads; fake GitHub page github.com/LastPass-Authenticator ranks in search results and mimics a real product page
  • BYOVD driver Alinubx.sys, signed via Microsoft Windows Hardware Compatibility Publisher (March 2023), is a renamed copy of CnCrypt's CcProtect.sys and kills 145 antivirus/EDR processes from the kernel; scored zero VirusTotal detections and is absent from Microsoft's driver blocklist
  • ZIP archives (148 MB / 127.9 MB) are padded with junk files to evade size-limited scanners; loader uses vsdbg.exe DLL side-loading, escalates to SYSTEM, installs driver as service NvFsFilter at C:\Windows\System32\drivers\nvfsflt64.sys
  • Stealer harvests saved passwords from 25+ browsers (bypassing Chrome/Edge app-bound encryption via browser injection), crypto wallet files, Discord/Steam/Telegram sessions, Credential Manager, and password/seed/recovery files, exfiltrating them as a ZIP; payload re-runs on every reboot
  • Attacker server hosted impersonation pages for at least 40 brands; LastPass says its own systems and customer vaults were not affected
  Sources 📎 Coverage: thehackernews.com · 👁 via The Hacker News

🕵️ RESEARCH & DEEP DIVES

• ZTE SmartLife password reset flaw (CVE-2026-86553) enabled account takeover; four CVEs patched CVE-2026-86553
  A researcher found that ZTE SmartLife's account backend allowed password resets without any verification code, enabling account takeover.
  • Affects ZTE SmartLife Android app (com.zte.smarthome.abroad v2.8.1) and its cloud account backend, with 100K+ Google Play downloads plus App Store distribution.
  • CVE-2026-86553 (CVSS 8.8 High): the reset endpoint accepted a target accountId and new password without a reset code, old password, or validated reset transaction; another endpoint exposed registered emails and their backend account IDs.
  • Attack chain: email -> accountId -> password reset -> login with the new password; researcher verified the old password stopped working and the new one returned a valid session.
  • The app embedded recoverable trust material, including a hardcoded AES-128-GCM bootstrap key (CVE-2026-86555), a client AES-GCM key, shared account secrets, and a plaintext RSA-2048 camera mTLS private key, letting researchers reconstruct app-auth headers against zxuacde.smart-zte.com.
  • ZTE PSIRT verified four vulnerabilities and assigned CVE IDs after remediation; account-deletion behavior was assessed as test-environment-only and excluded.
  Sources 📄 Source: support.zte.com.cn · 📎 Coverage: minanagehsalalma.github.io · 👁 via r/netsec

📋 ADVISORIES

• 📄 Source for North Korean Contagious Interview Campaign Hit 30,000 Devices, Stole $10.71M in Crypto — npa.go.jp

• 📄 Source for Three ntopng flaws allow non-admins to leak credentials, tamper with blocklists, and run OS commands — github.com

🔓 CVEs & KEV

• CVE-2026-79920 — ajenti — CVSS 9.9 — Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin ...

• CVE-2026-61674 — fluent fluent-bit — CVSS 9.2 — Fluent Bit: Remote stack buffer overflow in Fluent Bit out_forward Secure-F...

• CVE-2026-76898 — jgraph drawio — CVSS 7.7 — draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsdraw...

• CVE-2026-63334 — jgraph drawio — CVSS 6.8 — draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist...

• CVE-2026-58504 — jgraph drawio — CVSS 6.1 — draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass o...