Threat Deep Dive: The Fake App Installer That Switches Off Your Security
This week's news included a fake installer for the LastPass authenticator app. It doesn't just look convincing, it uses a Microsoft-signed driver to try to switch off antivirus and security tools on the machine. That's why it's worth a proper look on today's Threat Deep Dive.
The trick is old and it still works. You search for an app, you click something that looks official, and you download a version that isn't. The download page looks right. The logo is right. The file name is close enough. And because part of it is signed by Microsoft, some security software treats it as trustworthy.
Once it's running, it tries to stop the antivirus. Then it sits quietly and goes after passwords, browser data and crypto wallets. It's a long game, not a smash and grab.
Who is actually at risk here? Mostly people who go looking for a free download. That might be a free version of paid software, a cracked key, or an app that isn't in the official store in the first place. If you only ever install from the App Store, the Play Store, or the maker's own website, you're a long way from harm.
Here's the practical bit. Download apps the official way, every time. Ignore search ads and pop-ups promising a free version. If you think you've already installed something like this, uninstall it, run a full scan, and change your important passwords from a different device. None of that takes long, and it's a lot less fuss than a compromised bank account.
One rule, and it covers most of this: official store, or official website. Nothing else.
Related reading