Lunex Stealer Turns an AMD Driver Against the Very Tools Meant to Stop It

Security firm Ontinue has published an analysis of Lunex, a malware-as-a-service (MaaS) platform. Its information stealer, known as Psychedelic Stealer, spreads through compromised Ukrainian websites and is aimed primarily at Ukrainian-speaking users.

A four-stage chain

The attack opens with a fake CAPTCHA page in the ClickFix style, mimicking a Cloudflare check. Bogus MSI installers then deliver a loader called LunexLoader, which bypasses Windows User Account Control (UAC) via the CMSTPLUA COM object before pulling down the main payload.

The standout move is a Bring Your Own Vulnerable Driver technique: the attackers exploit a vulnerable AMD Radeon Software driver (PDFWKRNL.sys, CVE-2023-20598) to escalate privileges and blind security-related processes. Rather than killing those tools, it leaves them running but blind by zeroing kernel callbacks. According to Ontinue, neither HVCI nor Microsoft's current Vulnerable Driver Blocklist stops this driver variant from loading — even though its hash has been catalogued in the LOLDrivers project since March 2026. Such a technique rarely precedes an ordinary info-stealer.

What Psychedelic takes

The stealer pulls credentials from seven Chromium-based browsers — Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi — plus data from five desktop crypto wallets (Bitcoin Core, Litecoin, Exodus, Atomic Wallet, Electrum) and four browser-extension wallets (MetaMask, MetaMask Legacy, OKX Wallet, SafePal Wallet).

Persistence comes via a Registry Run key, a hidden scheduled task named "psychedelicloveUtils," and a Chrome native-messaging host. That host is a 13,200-byte PowerShell script embedded in the .rdata section; it runs inside Chrome's process context and survives deletion of the stealer binary, reboots, and browser restarts. The script can enumerate drives and directories, read and write arbitrary files, download data, and run programs. A malicious Chrome extension with sweeping permissions is also injected, granting full control over browser activity.

A growing platform

Analysis of the control panel points to a Russian-speaking developer. Where June 2026 saw six known C2 panels, there are now 28 across 13 countries. One panel in Turkey is tied to phishing domains impersonating Sam's Club, Namshi, WhatsApp Business, and others — showing the platform offers not just credential theft but phishing as well.

Source: The Hacker News