Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Summary

The Lunex Stealer, also known as Psychedelic Stealer, is a malware-as-a-service platform targeting Ukrainian-speaking users. It employs a four-stage attack chain, beginning with a fake CAPTCHA page and culminating in the deployment of a C2 agent. The stealer extracts credentials from Chromium-based browsers, exfiltrates cryptocurrency wallet data, and establishes persistence by abusing a vulnerable AMD driver (CVE-2023-20598) to escalate privileges and disable security monitoring.

Full text

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials Ravie LakshmananSep 26, 2026Malware / Endpoint Security The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent," Ontinue threat researcher Rhys Downing said in a technical report. "The stealer extracts credentials and data from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access through a PowerShell-based Native Messaging Host installed within the victim's browser." The infection makes use of bogus MSI installers delivered via ClickFix to trigger a series of actions, including delivering a loader dubbed LunexLoader that's designed to bypass User Account Control (UAC) on Windows using the CMSTPLUA COM object, leverage the bring your own vulnerable driver (BYOVD) attack for defense evasion, and finally download the stealer payload. The use of the BYOVD technique is significant, not least because it's rarely employed as a precursor to a final-stage payload like an information stealer. Lunex takes advantage of a vulnerable kernel-mode driver for AMD Radeon Software ("PDFWKRNL.sys"), which is susceptible to CVE-2023-20598, to escalate privileges and blind security-related processes while keeping them running. Psychedelic Stealer was first documented earlier this week by Arctic Wolf Labs, detailing the threat actor's modus operandi of compromising legitimate websites belonging to a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer to inject an iframe element designed to serve the ClickFix lure. "Our analysis of the attack chain found that, before the stealer is delivered, the malware is designed to use a legitimate but vulnerable driver to switch off security tools on the victim's machine. With those protections disabled, the information stealer is then deployed to take browser passwords, session cookies, and cryptocurrency wallet data," Downing told The Hacker News. The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when BlueTeamCoolTeam's Luke Wilkinson identified six active Lunex Stealer's command-and-control (C2) panels across the U.S., Finland, Germany, the Netherlands, and Ukraine. LunexStealer (aka Psychedelic Stealer) C2 Panel | Source: BlueTeamCoolTeam It's worth noting that both Psychedelic Stealer and LunexStealer refer to the same component of the MaaS platform. "'Psychedelic' is the name of the malware file that runs on victims' devices, while Lunex is the underlying platform being sold to multiple criminal groups, which is the reason for the name 'Lunex' and 'LunexStealer,'" Downing explained. Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft - Steal credentials from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. Enumerate five desktop cryptocurrency wallets, Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum, and four browser extension wallets, MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet, and exfiltrate relevant data from them. Establish persistence using a Registry Run key, a hidden scheduled task named "psychedelicloveUtils," and register a Chrome native-messaging bridge or host (NMH) that allows the stealer to perform additional actions. "The host is backed by a 13,200-byte PowerShell script embedded in the .rdata section that implements the Chrome Native Messaging protocol over standard input and output," Downing said. "The NMH operates within Chrome’s process context. It survives stealer binary deletion, system reboots, and browser restarts." The PowerShell script supports six file system actions - list_drives, to enumerate all drive letters C through Z list_dir, to list directory contents with file sizes read_file, to read arbitrary files in 512 KB chunks and those up to 524 MB write, to write arbitrary data to any file path download, to download files from the system run, to execute arbitrary programs What's more, LunexStealer injects a malicious Chrome extension by manipulating Chrome Secure Preferences and declares extensive permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs. This grants the extension complete visibility and control over a victim's browser activity. Analysis of the Lunex panel points to a Russian-speaking developer or development team, with 28 unique panels identified across 13 countries, marking a major expansion from June 2026. These panels are hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh. "That growth in just a few months shows the platform is actively expanding and being used by either one threat actor or sold for other actors, not just a single operator," Downing said. One of the panels hosted in Turkey has been found to resolve to five phishing domains - account-sams-club[.]com teamwork-recover-password[.]com namshi-uae[.]com whatsappbusineses[.]com ibraq-perfumes[.]com This indicates that the MaaS platform's feature set extends beyond credential theft to also enable brand impersonation and phishing. "The BYOVD delivery chain, using PDB-guided kernel callback zeroing rather than process termination, represents a quieter approach to EDR neutralisation that leaves security products running but blind," Ontinue said. "Validated testing demonstrated that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading, a gap that persists despite the driver hash being catalogued in the LOLDrivers project since March 2026." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, endpoint security, Malware, Phishing, Vulnerability, Windows ⚡ Top Stories This Week Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access t

Indicators of Compromise

• ip — 193.178.159.128
• cve — CVE-2023-20598
• mitre_attack — T1068
• mitre_attack — T1547.001
• mitre_attack — T1059.001
• mitre_attack — T1071.001

Entities