Lunex Stealer Abuses AMD Driver to Disable Security Tools and Steal Browser Credentials
The malware-as-a-service campaign documented by Ontinue uses compromised websites, a deceptive verification prompt and a vulnerable AMD Radeon driver to impair security software before collecting browser credentials, session data and cryptocurrency wallet information.
Key takeaways for local businesses
- The campaign documented by Ontinue targets Ukrainian-speaking users through compromised Ukrainian websites that display fake Cloudflare verification pages.
- The attack begins with a fake CAPTCHA or verification page, not a browser exploit. A person is persuaded to run a command or installer.
- A vulnerable AMD Radeon driver is used to leave endpoint security tools running but unable to report activity.
- The payload targets saved browser credentials, session cookies, cryptocurrency wallets and files, then installs a persistent browser native-messaging host.
- Businesses should have their IT provider confirm that Windows updates, driver blocklists, browser controls and endpoint protection are current.
What happened
According to Broadcom’s security bulletin, a campaign documented by Ontinue uses a fake CAPTCHA page and covert MSI installation to deliver the Lunex information stealer. Its loader gains elevation through the CMSTPLUA COM object, deploys the vulnerable AMD driver and attempts to impair endpoint security telemetry before the final payload extracts browser and cryptocurrency data and establishes persistent access through a malicious Native Messaging Host.
What is confirmed, and what is not
- Attack chain: Ontinue’s research documents the fake CAPTCHA, MSI loader, BYOVD activity, credential theft and persistence mechanism. Broadcom separately identifies the same sequence and its Symantec and Carbon Black protections.
- Driver weakness: The official CVE-2023-20598 record describes improper privilege management in the AMD Radeon Graphics driver. It carries a CVSS score of 7.8, while its affected and patched versions remain listed as unknown.
- Protection gap: According to Ontinue’s report, validated testing demonstrated that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading. Microsoft updates the blocklist quarterly and delivers updates through monthly Windows updates as part of standard servicing.
- Restoration: The source research and Broadcom bulletin do not say whether every compromised website has been restored.
- Vendor remediation: The cited material does not state that Microsoft or AMD issued a new remediation specific to this campaign. The CVE record points to AMD bulletin AMD-SB-6009.
- Origin: The assessment that a Russian-speaking developer or team operates the platform is researcher analysis based on panel language. It is not a confirmed attribution.
Are you affected?
The documented campaign targets Ukrainian-speaking users visiting compromised Ukrainian websites. The listed compromised businesses include a hair-treatment clinic, scale-model manufacturer, specialist bookseller, psychological facility, tool retailer and automotive retailer. The research does not list the affected Windows versions.
Also ask staff and IT staff whether they saw a Cloudflare-style CAPTCHA that asked them to paste a command into the Run dialog, PowerShell or another application.
The source provides general attack artifacts but does not give a simple confirmation checklist for individual computers. The maintainers have not listed affected Windows versions. Broadcom identifies the Symantec detections SONAR.Stealer!gen1, SONAR.SuspDrop!g35 and SONAR.SuspDriver!g30, along with Trojan.Gen.MBT and Heur.AdvML.B. Its Carbon Black guidance says associated indicators are blocked and detected by existing policies, and recommends blocking Known, Suspect and PUP malware while delaying execution for cloud scan.
What to do now
- Ask the IT provider to confirm Windows and driver protections are current. Check that monthly Windows updates are installed and that the vulnerable driver blocklist is enabled. Microsoft says blocklist updates arrive through monthly Windows updates, and businesses that need the latest list can apply the recommended rules through App Control for Business.
- Review HVCI and endpoint protection coverage. Microsoft says HVCI is on by default for most new Windows 11 devices and can be enabled in Windows Security. Ontinue found that HVCI did not stop the specific PDFWKRNL.sys variant in its test, so endpoint telemetry and detection coverage still need review.
- Ask staff not to run commands from website verification prompts. The documented ClickFix lure uses a fake CAPTCHA and relies on the visitor to execute a malicious command or installer. Staff should stop and contact the IT provider if a website asks them to paste text into the Run dialog, PowerShell or another application.
- Search for the documented persistence and network indicators. Have the IT provider check for the hidden scheduled task named
psychedelicloveUtils, Registry Run-key activity, Chrome Secure Preferences manipulation, a Chrome native-messaging host and traffic involving193.178.159[.]128. - Protect credentials held in browsers. Review saved passwords, active sessions and cryptocurrency wallet extensions on staff accounts. Do not rely on browser-stored passwords as the only barrier to account takeover.
How does the Lunex attack chain unfold?
Stage 1: A compromised website presents a fake verification page
The operator inserts an iframe on legitimate sites that serves a ClickFix-style fake Cloudflare CAPTCHA. Research cited by Ontinue describes instructions that can place a command on the clipboard and persuade the visitor to paste it into the Windows Run dialog. The additional analysis from Security Arsenal characterizes this as user execution, with the person, rather than a browser exploit, completing the malicious command.
Stage 2: The MSI installer delivers LunexLoader
Broadcom lists the installer as elita.msi. The loader uses the auto-elevated CMSTPLUA COM object to raise its privileges, downloads the kernel symbol file ntkrnlmp.pdb with curl.exe, and prepares the vulnerable AMD driver for loading.
Stage 3: The vulnerable driver impairs security monitoring
The driver is PDFWKRNL.sys, an AMD Radeon Software file linked to CVE-2023-20598. Ontinue describes PDB-guided kernel callback zeroing rather than process termination. The security application can remain active while losing visibility into system activity.
Stage 4: Psychedelic Stealer collects data and persists
The final payload targets Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi. It also enumerates Bitcoin Core, Litecoin, Exodus, Atomic Wallet and Electrum, plus MetaMask, MetaMask Legacy, OKX Wallet and SafePal Wallet.
Persistence comes through a Registry Run key, the hidden psychedelicloveUtils scheduled task and a Chrome native-messaging host. The source describes a 13,200-byte PowerShell script embedded in the malware’s .rdata section. It supports list_drives, list_dir, read_file, write, download and run.
Lunex also manipulates Chrome Secure Preferences to install a malicious extension with access to cookies, history, bookmarks, tabs, storage, proxy settings, scripting, declarative network requests and HTTP and HTTPS URLs.
What data and persistence should the IT provider examine?
The stolen browser material can include passwords, session cookies and cryptocurrency wallet information. The campaign’s persistence may be designed to survive deletion of the stealer binary, system restarts and browser restarts.
Security Arsenal says the loader writes a signed but vulnerable driver to a user-writable location, creates a service and loads the driver from a non-standard path. It also recommends hunting for browser-spawned script interpreters, user-writable driver loads, non-browser processes accessing browser credential stores and the Windows RunMRU registry key, which records commands entered through the Run dialog.
The platform grew from six command-and-control panels identified in June 2026 to 28 across 13 countries, according to the source. Panels were reported in Russia, the United States, the United Kingdom, the Netherlands, France, Germany, Turkey and Bangladesh. One Turkey-hosted panel resolved to five phishing domains, showing use of the platform for phishing and brand impersonation as well as credential theft.
What local businesses should do now
Start by identifying every computer used for customer, payment or employee access. Ask the IT provider to document who manages endpoint protection, confirm that Windows updates and driver controls are current, and review local administrator accounts. A short list of records showing which devices have access to customer data can serve as a practical starting point for the IT provider.
Next, inventory browser extensions across staff computers. Record any wallet, banking, booking, point-of-sale or productivity extension, and remove extensions that staff no longer use. The attacker’s browser extension and native-messaging host can survive after the original malware file is deleted, so extension reviews belong in the response plan.
Website owners should also speak with the hosting or web-development provider. A compromised legitimate site can expose every visitor to a fake verification prompt, including customers checking a clinic, shop or service page. Ask who monitors the site’s content, how quickly unauthorized frames or scripts would be removed, and whether the affected sites from the research have been reviewed and restored.
FAQ
What is Lunex Stealer?
Lunex Stealer, also called Psychedelic Stealer or LunexStealer, is the information-stealer component of the Lunex malware-as-a-service platform. The platform is sold to multiple criminal groups and uses a fake CAPTCHA, an MSI loader, a vulnerable-driver technique and a final stealer payload.
How does Lunex disable security software?
Lunex loads the vulnerable AMD Radeon driver PDFWKRNL.sys, associated with CVE-2023-20598. Ontinue says the technique uses PDB-guided kernel callback zeroing, leaving security products running but unable to monitor activity. Its validated test found that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist stopped the tested variant from loading.
What should a local business check after a fake CAPTCHA prompt?
Ask the IT provider to review Windows updates and the vulnerable driver blocklist, confirm endpoint protection is active, inspect browser extensions and saved sessions, and search for the documented scheduled task, Registry Run-key activity, Chrome Secure Preferences changes, native-messaging host and network indicator.