Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Lunex Stealer abuses AMD driver to disable security monitoring and steal browser credentials.
The Lunex Stealer, also known as Psychedelic Stealer, is a malware-as-a-service platform targeting Ukrainian-speaking users. It employs a four-stage attack chain, beginning with a fake CAPTCHA page and culminating in the deployment of a C2 agent. The stealer extracts credentials from Chromium-based browsers, exfiltrates cryptocurrency wallet data, and establishes persistence by abusing a vulnerable AMD driver (CVE-2023-20598) to escalate privileges and disable security monitoring.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AMD Radeon Software?
Get an email when a new story names AMD Radeon Software, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Lunex Stealer exploits CVE-2023-20598, a known vulnerability in an AMD driver, to escalate privileges and disable endpoint security monitoring — a technique known as Bring Your Own Vulnerable Driver (BYOVD). This allows attackers to operate undetected while harvesting browser credentials and cryptocurrency wallet data across multiple stages. The attack begins with a social engineering lure (fake CAPTCHA) and progresses to full C2 agent deployment, demonstrating how unpatched drivers in the kernel layer create catastrophic blind spots for defenders. The fact that this vulnerability was disclosed in 2023 and is still being weaponized highlights the critical gap between patch availability and operational patch deployment.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 193.178.159.128
- cve — CVE-2023-20598
- mitre_attack — T1068
- mitre_attack — T1547.001
- mitre_attack — T1059.001
- mitre_attack — T1071.001