Lunex Stealer Abuses AMD Driver to Blind Endpoint Security

Key takeaways

• to zero kernel callbacks and blind EDR sensors without terminating processes.
• Defensive Blindspot: Tested instances bypass both Windows Hypervisor-Protected Code Integrity (HVCI) and the Microsoft Vulnerable Driver Blocklist, despite cataloging in LOLDrivers since March 2026.
• Browser-Based Foothold: Persistence is established via a 13,200-byte PowerShell script registered as a Chrome Native Messaging Host and unauthorized extensions injected via Chrome Secure Preferences.

Lunex Stealer, also known as Psychedelic Stealer, is an expanding malware-as-a-service (MaaS) platform deploying a four-stage attack chain against Ukrainian-speaking users to disable security monitoring and harvest credentials. Distributed primarily through compromised websites hosting counterfeit Cloudflare “ClickFix” verification checks, the infection leverages a Bring Your Own Vulnerable Driver (BYOVD) attack using AMD Radeon Software’s PDFWKRNL.sys driver (CVE-2023-20598). By zeroing kernel callbacks, the loader blinds endpoint detection and response (EDR) platforms without terminating their processes, enabling unhindered theft of browser credentials, cryptocurrency wallets, and persistent filesystem access.

The campaign represents a shift in commodified cybercrime. While BYOVD evasion has typically been limited to high-value ransomware operations, Lunex integrates kernel-level evasion into an entry-level stealer platform sold across cybercriminal forums.

Four-stage attack chain and BYOVD evasion

The infection begins when users visit compromised legitimate websites, including regional hair clinics, psychological facilities, bookshops, and retail outlets. Threat actors inject malicious iframes that present a fake Cloudflare verification overlay. Under the guise of a CAPTCHA, the page automatically copies an encoded Windows Installer command to the system clipboard and prompts the victim to execute it via the Windows Run dialog (Win + R).

Once triggered, the command retrieves an MSI package that drops LunexLoader. The loader conducts privilege escalation and evasion through a structured sequence:

1. User Account Control (UAC) Bypass: LunexLoader elevates privileges silently by abusing the CMSTPLUA Component Object Model (COM) interface.
2. Vulnerable Driver Staging: The malware drops and registers a signed AMD Radeon Software kernel-mode driver, PDFWKRNL.sys.
3. Kernel Callback Neutralization: Exploiting CVE-2023-20598, the loader gains arbitrary kernel read/write access. Using PDB symbol parsing, it zeroes out registered security callback arrays in kernel memory.
4. Payload Deployment: With endpoint visibility eliminated, the loader downloads and executes the stealer payload.

According to technical analysis by cybersecurity firm Ontinue, this callback-zeroing technique represents a stealthier approach to EDR neutralization. Rather than terminating security binaries—which triggers watchdog alerts—security agents remain running in Task Manager while their underlying sensor telemetry is suppressed.

Technical Parameters of the Lunex BYOVD Attack Chain

Component	Mechanism	Defensive Gap
Delivery Vector	ClickFix fake CAPTCHA iframe	Social engineering via Windows Run prompt
Privilege Escalation	CMSTPLUA COM interface abuse	Bypasses default Windows UAC thresholds
Exploited Driver	AMD Radeon Software (PDFWKRNL.sys)	CVE-2023-20598 grants arbitrary kernel read/write
Defense Neutralization	PDB-guided kernel callback zeroing	Leaves EDR agents running while blinding sensors
System Enforcement	HVCI and Microsoft Vulnerable Driver Blocklist	Bypasses blocklist despite LOLDrivers listing since March 2026

Testing confirmed that neither Windows Hypervisor-Protected Code Integrity (HVCI) nor Microsoft’s Vulnerable Driver Blocklist prevented this driver from loading, despite the hash being cataloged in LOLDrivers since March 2026.

Credential harvesting and browser persistence mechanisms

Once active, LunexStealer (documented earlier by Arctic Wolf Labs as Psychedelic Stealer) initiates credential harvesting across seven Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. The malware decrypts stored autofill records, saved passwords, and authenticated session tokens.

The stealer also targets cryptocurrency assets, scanning for five desktop wallet applications (Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum) and four browser extension wallets (MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet).

To retain persistent access independent of its primary binary, LunexStealer establishes three footholds:

• Registry Run Keys: Standard user-level execution keys to survive reboots.
• Scheduled Tasks: A hidden scheduled task named psychedelicloveUtils.
• Native Messaging Host (NMH): A bridge registered within Chrome’s native messaging infrastructure.

The native messaging bridge is backed by a 13,200-byte PowerShell script embedded in the binary’s .rdata section. Executing within Chrome’s process context over standard input and output streams, it survives binary deletion, system reboots, and browser restarts. The script supports six filesystem operations: listing drive letters, enumerating directories, reading files up to 524 MB in 512 KB chunks, writing data, downloading files, and executing arbitrary programs.

Get the Weekly Brief

Curated analysis for tech leaders. Every Thursday.

Subscribe

Additionally, the malware alters Chrome’s Secure Preferences to inject an unauthorized extension. Configured with permissions across all URLs, scripting, cookies, web requests, and storage, the extension provides continuous visibility over user browsing activity.

Expanding MaaS footprint and phishing infrastructure

Infrastructure analysis indicates Lunex is an expanding commercial platform. Research published by BlueTeamCoolTeam in June 2026 initially identified six active command-and-control (C2) panels across the United States, Finland, Germany, the Netherlands, and Ukraine.

By late September 2026, researchers mapped 28 panels across 13 countries, including Russia, the United Kingdom, France, Turkey, and Bangladesh. The panels feature Russian-language administrative interfaces and communicate with hosts over HTTP, including infrastructure at 193.178.159[.]128.

Investigators also observed Lunex infrastructure supporting brand-impersonation phishing. A panel in Turkey resolved to domains spoofing retail and communications portals, including fake verification pages for Sam’s Club, WhatsApp Business, and enterprise password reset services. This activity reinforces why enterprises are automating security risk management across enterprise IT operations to detect credential compromise early.

Furthermore, evaluating endpoint self-defense against kernel-level tampering remains central when reviewing modern platforms, such as those evaluated in CrowdStrike proactive security platform benchmarks.

What happens next

The campaign exposes gaps in default driver blocking. Enterprise IT directors and security teams should adopt the following mitigations:

• Deploy Custom Driver Blocklists: Do not rely solely on default Windows blocklists or HVCI. Deploy proactive Windows Defender Application Control (WDAC) or AppLocker policies that incorporate hashes from the community-maintained LOLDrivers database.
• Audit Native Messaging and Extension Registrations: Monitor Chrome Native Messaging Hosts (HKCU\Software\Google\Chrome\NativeMessagingHosts) and browser extension directories. Enforce enterprise Group Policy Objects (GPOs) to block unauthorized extensions and host manifests.
• Detect COM Interface Abuse: Monitor endpoint telemetry for suspicious invocations of the CMSTPLUA COM object used for UAC bypass.
• Monitor Telemetry Anomalies: Configure alerts for sudden drops in telemetry from active security processes, signaling callback zeroing or unhooking.

Moving forward, hardware vendors and OS maintainers face mounting pressure to accelerate driver certificate revocations and bridge the gap between reported vulnerable drivers and active enterprise blocklists.

Sources

• Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
• The Psychedelic Stealer: When a CAPTCHA Becomes an Installer – Arctic Wolf
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVD
• The Panel Behind the Prompt: OSINT into a Live Lunex Stealer Network | BlueTeamCoolTeam