Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Summary: Ontinue documented a four-stage attack chain in which ClickFix lures on compromised Ukrainian websites deliver a bogus MSI installer, a loader called LunexLoader that bypasses Windows User Account Control via the CMSTPLUA COM object, and then Psychedelic Stealer, the payload of a malware-as-a-service platform called Lunex. The stealer uses the vulnerable AMD Radeon driver PDFWKRNL.sys (CVE-2023-20598) to escalate privileges and blind security processes while leaving them running, then extracts credentials from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and installs a PowerShell-based Native Messaging Host that survives stealer deletion, reboots, and browser restarts.
Key Takeaway: Ontinue's testing found that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist stops this PDFWKRNL.sys variant from loading, even though its hash has been in the LOLDrivers project since March 2026 - so your EDR can stay running and still be blind. The Lunex panel count has grown to 28 unique panels across 13 countries since June 2026, with hosting traced to Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2023-20598
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026