Security teams gain visibility into a new malware-as-a-service platform called Lunex that abuses a vulnerable AMD kernel driver to disable endpoint monitoring before stealing browser credentials and cryptocurrency wallet data from infected Windows machines.<\/p>\n
The attack chain, analyzed in a technical report from Ontinue, unfolds in four stages. It starts with a fake Cloudflare-style CAPTCHA page, delivers a loader designed to bypass Windows User Account Control, uses a vulnerable AMD Radeon driver for defense evasion, and finishes with the deployment of the stealer payload, marketed under the name Psychedelic Stealer.<\/p>\n
Victims are lured to compromised Ukrainian websites through injected iframes that display a ClickFix-style verification page. The earlier research, published by Arctic Wolf Labs, identified six legitimate sites that had been weaponized: a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.<\/p>\n
Once the user interacts with the fake page, a bogus MSI installer is delivered, which drops a loader called LunexLoader. The loader uses the CMSTPLUA COM object to bypass UAC, then loads a vulnerable kernel-mode driver for AMD Radeon Software, known as PDFWKRNL.sys, which is susceptible to CVE-2023-20598. This is a classic bring-your-own-vulnerable-driver (BYOVD) technique, used here as a prelude to information theft rather than a final payload.<\/p>\n
The PDFWKRNL.sys driver is used to escalate privileges and to blind security-related processes without terminating them. According to the report, the technique zeroes kernel callbacks via a PDB-guided approach, which leaves endpoint detection and response (EDR) products running but unable to see what the stealer is doing.<\/p>\n
Validated testing showed that neither Hypervisor-Protected Code Integrity (HVCI) nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading. The driver hash has been catalogued in the LOLDrivers project since March 2026, yet the gap remains.<\/p>\n
Once the security layer is neutralized, the stealer performs comprehensive data theft. It targets seven Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. From these browsers it extracts saved credentials, session cookies, and other data.<\/p>\n
On the cryptocurrency side, LunexStealer enumerates five desktop wallets (Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum) and four browser extension wallets (MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet). Exfiltrated wallet data can give attackers direct access to funds.<\/p>\n
The stealer establishes multiple layers of persistence. It writes a Registry Run key, creates a hidden scheduled task named “psychedelicloveUtils,” and registers a Chrome native-messaging host (NMH). The NMH is backed by a 13,200-byte PowerShell script embedded in the .rdata section of the stealer binary and implements the Chrome Native Messaging protocol over standard input and output.<\/p>\n
This host operates inside Chrome’s process context and survives stealer binary deletion, system reboots, and browser restarts. The PowerShell script supports six file system actions: list_drives (enumerate drive letters C through Z), list_dir (list directory contents with file sizes), read_file (read arbitrary files in 512 KB chunks up to 524 MB), write (write arbitrary data to any file path), download (download files from the system), and run (execute arbitrary programs). Together, these give the operator persistent remote filesystem access through the victim’s own browser.<\/p>\n
In addition, LunexStealer injects a malicious Chrome extension by manipulating Chrome Secure Preferences. The extension declares extensive permissions covering cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs, giving the attacker complete visibility and control over browser activity.<\/p>\n
The earliest reference to Lunex in cybersecurity literature dates to June 2026, when six active command-and-control (C2) panels were identified across the U.S., Finland, Germany, the Netherlands, and Ukraine. By September, that number had grown to 28 unique panels across 13 countries, hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh. Analysis of the panel code points to a Russian-speaking developer or development team.<\/p>\n
One of the panels hosted in Turkey has been found resolving to five phishing domains: account-sams-club[.]com, teamwork-recover-password[.]com, namshi-uae[.]com, whatsappbusineses[.]com, and ibraq-perfumes[.]com. This indicates that the platform’s feature set extends beyond credential theft to also enable brand impersonation and phishing.<\/p>\n
The naming can cause confusion. Psychedelic is the name of the malware file that runs on victim devices, while Lunex is the underlying malware-as-a-service platform sold to multiple criminal groups. LunexStealer refers to the same component of the platform as Psychedelic Stealer. The growth in panel count over a few months suggests the platform is actively expanding and either used by one threat actor or sold to multiple operators, not run by a single operator.<\/p>\n
Upon execution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP. This is the primary C2 endpoint used to receive commands and exfiltrate stolen data.<\/p>\n
The BYOVD delivery chain here uses kernel-callback zeroing rather than process termination, which represents a quieter approach to EDR neutralization. Because neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents this specific PDFWKRNL.sys variant from loading, the gap persists despite the hash being catalogued since March 2026. Defenders should pay close attention to PDFWKRNL.sys load events, suspicious Chrome native-messaging host registrations, and unexpected PowerShell activity inside the browser process context, and consider whether their endpoint protection can detect kernel-callback tampering even when EDR processes remain visible and running.<\/p>\n
Lunex Stealer, also known as Psychedelic Stealer, is the information-stealing component of a malware-as-a-service platform called Lunex. It targets Chromium-based browsers, desktop and browser-extension cryptocurrency wallets, and provides persistent remote access through a PowerShell-based Chrome native-messaging host.<\/p>\n
Lunex uses a bring-your-own-vulnerable-driver (BYOVD) technique with the AMD Radeon kernel driver PDFWKRNL.sys, which is susceptible to CVE-2023-20598. The driver is used to escalate privileges and zero kernel callbacks, leaving EDR products running but unable to monitor activity. Neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific variant used in this chain from loading.<\/p>\n
Lunex Stealer steals credentials, session cookies, and other data from seven Chromium-based browsers: Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. It also targets five desktop wallets (Bitcoin Core, Litecoin, Exodus, Atomic, Electrum) and four browser extension wallets (MetaMask, MetaMask Legacy, OKX Wallet, SafePal), and it can read and write arbitrary files on the system through a persistent native-messaging host.<\/p>\n