Lunex Stealer: BYOVD With an AMD Driver Blinds EDR, Then Steals Credentials

What Ontinue found

Ontinue's report, "Lunex Unmasked: A New Information Stealer Deployed Through BYOVD", describes a four-stage attack chain. As The Hacker News reports, it begins with a fake CAPTCHA page and ends with a fully featured C2 agent. The stealer that the reporting calls Psychedelic Stealer is one part of a wider malware-as-a-service platform named Lunex.

The reported chain runs as follows: a ClickFix-style Cloudflare verification lure on compromised Ukrainian websites, a bogus MSI installer, a loader called LunexLoader that performs a UAC bypass, and finally the stealer payload.

Why the AMD driver matters

The notable step is the use of a vulnerable AMD Radeon kernel driver, PDFWKRNL.sys, which is affected by CVE-2023-20598. This is a BYOVD technique: the attacker brings a legitimately signed but vulnerable driver and abuses it to gain kernel-level capability, so the operating system's driver-signing check is satisfied.

According to the report, the goal is not to terminate security tooling. The malware blinds security-related processes while keeping them running. That is harder to spot than a killed agent. A console that shows the sensor as running can mask the fact that it is no longer seeing anything useful.

What gets stolen

• Browser credentials from Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi.
• Cryptocurrency wallets including Bitcoin Core, Litecoin, Exodus, Atomic Wallet, Electrum, MetaMask, OKX Wallet and SafePal.
• Operator access via a Chrome Native Messaging Host driven by embedded PowerShell, supporting drive and directory listing, arbitrary file read and write, download, and program execution.

Scale and attribution

Ontinue's analysis points to a Russian-speaking developer or development team. Its earliest reference dates to June 2026, and the report counts 28 unique panels across 13 countries. The MaaS model means the lure and targeting may vary between customers even though the tooling is shared, so the current Ukrainian focus should not be read as a hard boundary.

Practical defensive takeaways

1. 1Alert on loads of known-vulnerable drivers such as PDFWKRNL.sys, and enforce a vulnerable-driver blocklist where your OS and EDR support one.
2. 2Do not rely on agent heartbeat alone. Check that telemetry is still flowing for a host, and treat silent hosts as suspect.
3. 3Train users, and restrict where possible, against pasting commands or running installers prompted by a verification page. Legitimate CAPTCHAs do not ask for either.
4. 4Audit browser extensions and native messaging host registrations on endpoints, and use hardware-backed or passkey authentication so stolen browser-stored passwords are less useful.

Limits of the public reporting

The details above come from Ontinue's analysis as summarised by The Hacker News. We have not independently reproduced the sample, and readers should consult the original report for indicators of compromise before hunting.