{"id":1418,"date":"2026-10-09T17:13:36","date_gmt":"2026-10-09T17:13:36","guid":{"rendered":"https:\/\/seoscanpro.ai\/blog\/lunex-stealer-amd-driver-byovd\/"},"modified":"2026-10-26T05:24:50","modified_gmt":"2026-10-26T05:24:50","slug":"lunex-stealer-amd-driver-byovd","status":"publish","type":"post","link":"https:\/\/seoscanpro.ai\/blog\/lunex-stealer-amd-driver-byovd\/","title":{"rendered":"Lunex Stealer Abuses AMD Driver to Disable Security Tools and Steal Browser Credentials"},"content":{"rendered":"
Updated October 26, 2026 at 1:12 AM ET<\/em><\/div>\n

Ontinue’s analysis of the attack chain found that it begins with a fake CAPTCHA page and that, before the stealer is delivered, the malware is designed to use a legitimate but vulnerable driver to switch off security tools on the victim’s machine, then take browser passwords, session cookies, and cryptocurrency wallet data. Lunex reaches victims through compromised legitimate websites that have had a hidden iframe injected to serve a ClickFix lure. The activity was detailed by security firm Ontinue and targets Ukrainian-speaking users in a four-stage attack chain.<\/p>\n

What happened<\/h2>\n

Ontinue documented a campaign that delivers the Psychedelic Stealer, part of a wider malware-as-a-service platform called Lunex, through fake Cloudflare-style CAPTCHA verification pages. According to Ontinue, the chain ends with a fully featured command-and-control agent that extracts credentials from seven Chromium-based browsers, drains cryptocurrency wallets, and keeps persistent remote access through a PowerShell-based native messaging host inside the victim’s browser. The same campaign is described in an official Broadcom protection bulletin<\/a>, which lists the Symantec signatures that detect it.<\/p>\n

Are you affected?<\/h2>\n

More than one group is worth considering here. The first is Windows users who land on a fake CAPTCHA page, which begins a covert MSI installation. The second is owners of legitimate websites, because the operators compromise real sites and inject an iframe that serves the ClickFix lure.<\/p>\n

The abused driver is a kernel-mode driver for AMD Radeon Software, PDFWKRNL.sys, which is vulnerable to CVE-2023-20598. The GitHub Security Advisory Database<\/a> describes that flaw as a high-severity issue: An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I\/O control over arbitrary hardware ports or physical addresses resulting in a potential arbitrary code execution. Ontinue reported that its validated testing showed "neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading, a gap that persists despite the driver hash being catalogued in the LOLDrivers project since March 2026." If you rely on those two controls alone, they do not stop this variant. Website owners can confirm whether their own pages have been tampered with by checking what each page actually serves to a visitor, specifically any iframe that should not be there.<\/p>\n

What to do now<\/h2>\n
    \n
  1. Treat any CAPTCHA page that asks you to copy, paste, or run a command or an installer as hostile, and close it. The infection begins when a fake CAPTCHA delivers a malicious MSI installer.<\/li>\n
  2. Keep your operating system and drivers up to date, and follow vendor guidance for vulnerable drivers.<\/li>\n
  3. Check Windows for the persistence markers Ontinue listed: a Registry Run key, a hidden scheduled task named "psychedelicloveUtils," and a Chrome native messaging host, plus HTTP traffic to the Lunex panel at 193.178.159[.]128.<\/li>\n
  4. If you run a website, audit each page for injected iframe elements and confirm nothing is serving a CAPTCHA-style lure to visitors.<\/li>\n
  5. Refer to the Broadcom bulletin, which lists Symantec detection signatures and says "Symantec protects you from this threat."<\/li>\n<\/ol>\n

    How does the Lunex attack chain work?<\/h2>\n

    Ontinue described a four-stage chain. In its technical report, the firm said "The attack chain begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent." A bogus MSI installer, delivered via ClickFix, triggers a loader called LunexLoader. That loader bypasses Windows User Account Control through the CMSTPLUA COM object, uses the bring your own vulnerable driver technique for defense evasion, and then downloads the stealer payload. The use of the BYOVD technique is significant, not least because it is rarely employed as a precursor to a final-stage payload like an information stealer.<\/p>\n

    Which AMD driver does Lunex exploit?<\/h2>\n

    Lunex loads the vulnerable AMD Radeon Software kernel driver PDFWKRNL.sys to escalate privileges and blind security-related processes while keeping them running. The protections look active but cannot see the threat. Ontinue described the method as zeroing kernel callbacks rather than terminating processes, a quieter way to neutralize endpoint detection and response that leaves security products running but blind.<\/p>\n

    What does the stealer collect?<\/h2>\n

    Once active, the stealer communicates with the Lunex panel over HTTP and targets seven Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. It takes saved credentials, session cookies, and other browser data. For cryptocurrency theft it enumerates five desktop wallets, Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum, and four browser extension wallets, MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet.<\/p>\n

    How does Lunex stay on the machine?<\/h2>\n

    The stealer sets up persistence through a Registry Run key, a hidden scheduled task named "psychedelicloveUtils," and a Chrome native messaging host. Ontinue said "The host is backed by a 13,200-byte PowerShell script embedded in the .rdata section that implements the Chrome Native Messaging protocol over standard input and output." The host runs inside Chrome’s process and survives deletion of the stealer binary, system reboots, and browser restarts. The PowerShell script supports six file system actions: listing drive letters C through Z, listing directory contents with file sizes, reading arbitrary files in 512 KB chunks up to 524 MB, writing arbitrary data to any file path, downloading files from the system, and running arbitrary programs. Lunex also injects a malicious Chrome extension by manipulating Chrome Secure Preferences, declaring permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs, which gives the extension full visibility into browser activity.<\/p>\n

    How widespread is the Lunex platform?<\/h2>\n

    Lunex is sold to multiple criminal groups. Ontinue explained that "Psychedelic" is the malware file that runs on victim devices, while Lunex is the underlying platform, so Psychedelic Stealer and LunexStealer name the same component. The earliest reference to Lunex in cybersecurity research dates to June 2026, when six active command-and-control panels were identified across the U.S., Finland, Germany, the Netherlands, and Ukraine. Analysis now points to 28 unique panels across 13 countries, with infrastructure hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh, and signs of Russian-language development. One panel hosted in Turkey resolves to five phishing domains, which indicates the platform’s feature set extends past credential theft into brand impersonation and phishing.<\/p>\n

    What this means for your website<\/h2>\n

    Beyond that, keep your CMS and plugins patched, review file integrity, and remove any element you did not add.<\/p>\n

    FAQ<\/h2>\n

    What is Lunex Stealer?<\/h3>\n

    Lunex Stealer, also called Psychedelic Stealer, is information-stealing malware sold as part of a malware-as-a-service platform called Lunex. It targets browser credentials, cryptocurrency wallets, and files on Windows systems, and Ontinue reported it currently targets Ukrainian-speaking users.<\/p>\n

    How does Lunex disable antivirus software?<\/h3>\n

    Lunex uses the bring your own vulnerable driver technique, loading the vulnerable AMD Radeon Software kernel driver PDFWKRNL.sys, which is affected by CVE-2023-20598, to zero kernel callbacks. This leaves security products running but unable to see the threat, according to Ontinue.<\/p>\n

    Which browsers and wallets does Lunex target?<\/h3>\n

    It targets seven Chromium-based browsers: Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. It also targets the desktop wallets Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum, and the extension wallets MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet.<\/p>\n

    This article reports on publicly available information from the sources listed below. We have no reason to believe it is inaccurate, but we have not independently verified every claim, and details may change as the story develops. This is not financial, legal or investment advice.<\/em><\/div>\n
    \n

    Sources<\/h2>\n