We identified a WHQL-signed kernel driver keylogger, likely deployed as an anti-cheat BYOVD SHA2...
WHQL-signed kernel driver keylogger discovered, likely deployed via BYOVD anti-cheat abuse.
Run Xryus Technologies?
Get an email when a reviewed story names Xryus Technologies, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Security researchers identified a Windows Hardware Quality Labs (WHQL)-signed kernel driver that functions as a keylogger, apparently leveraged through a Bring Your Own Vulnerable Driver (BYOVD) technique for anti-cheat purposes. The malware, signed by Xryus Technologies, employs stealth techniques including API hashing and XOR string obfuscation. This represents a sophisticated privilege escalation attack exploiting legitimate driver signing mechanisms.
The lesson from this incident
Full lessonAttackers successfully obtained a legitimate Windows Hardware Quality Labs (WHQL) digital signature for a malicious keylogger driver, demonstrating a sophisticated supply chain compromise. By leveraging the trusted Microsoft signing process, the malware bypassed standard security controls that typically block unsigned or suspicious drivers. This Bring Your Own Vulnerable Driver (BYOVD) attack highlights how threat actors can abuse legitimate code signing infrastructure to deploy kernel-level malware with elevated privileges. The incident underscores the critical importance of verifying software authenticity beyond just digital signatures and implementing defense-in-depth strategies.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- hash_sha256 — bb1b4e46f1e4a7f17b1b04ee08c33400b2b6fd2327612a4d84da81e2656ba48b
- malware — WHQL-signed kernel keylogger