📝 Show notes
CyberAware Daily — 2026-09-22
- Threat Deep Dive: the fake app installer, and why it keeps working
- LastPass authenticator installer used as a decoy, paired with a Microsoft-signed driver to disable antivirus
- How the scam is spread: search ads, fake download pages, and 'free' versions of paid apps
- Why normal security software can look the other way
- What to do if you think you've already installed one
- The one rule that stops this: install only from the official app store or the maker's own website
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Tuesday, and that means it's our Threat Deep Dive, where we take one scam and pull it apart properly.
I like these episodes. They feel like we actually get somewhere.
Today it's the fake app installer. The one that pretends to be the free version of something you already use.
That rings a bell. Wasn't there something this week about a fake LastPass installer?
There was. LastPass makes the password manager, and someone built a fake installer for its authenticator app.
So it's a download that looks like the real thing.
It looks like the real thing, and that's the whole trick.
It even uses a driver that Microsoft has signed, so a lot of security software trusts it on site.
And what does it actually do once it's running?
It tries to switch off the antivirus on the machine.
Then it sits quietly and goes after passwords and crypto wallets.
Who is this aimed at?
Because most of us, just tap install and forget about it.
It's aimed at people who go looking for a free download.
Often that someone trying to save a few pounds, or someone who can't find the app in their official store.
That's a lot of us, honestly.
It is.
But there's one simple rule that stops nearly all of it.
Only ever install from the official app store on your phone, or the official website on your computer.
No search results, no ads, no download free buttons.
Exactly.
If you're on an iPhone, that's the app store.
Android, the Play store.
Windows or Mac, go to the maker's own site and nowhere else.
And what about paid software?
Sometimes people hunt for a key, or a cracked version.
That's the second target, and it's a big one.
On the same day, Google find a company over how it handled location data, so there's plenty of news about our information being traded.
How does that connect to the fake installer?
Because when we're worried about our data, we look for tools to protect ourselves.
And scammers build fake versions of those tools to catch us right at that moment.
So the protection is, want the app, get it the official way.
That's the takeaway.
That's the takeaway.
And if you've already installed something from a pop-up or a random link, you don't need to panic.
Uninstall it, run a full scan, change your important passwords from a different device.
Which is all doable in an afternoon.
Completely doable.
We'll be back tomorrow.