Lunex Stealer Uses AMD Driver to Disable Security and Steal Browser Data

September 26, 2026 at 11:22 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The Lunex Stealer malware-as-a-service platform uses a vulnerable AMD Radeon driver to disable security monitoring and steal credentials from seven Chromium-based browsers. The attack chain targets Ukrainian-speaking users through compromised websites and fake CAPTCHA pages. The stealer also exfiltrates cryptocurrency wallets and establishes persistent remote filesystem access.

Key Facts

Lunex Stealer abuses the vulnerable AMD Radeon driver PDFWKRNL.sys, susceptible to CVE-2023-20598, to escalate privileges and blind security processes.
The stealer extracts credentials and data from seven Chromium-based browsers and exfiltrates cryptocurrency wallets.
The attack chain begins with a fake CAPTCHA page and ends with deployment of a fully-featured C2 agent.
Psychedelic Stealer was first documented by Arctic Wolf Labs, which found compromised legitimate websites serving ClickFix lures.
BlueTeamCoolTeam identified six active Lunex Stealer C2 panels across the U.S., Finland, Germany, the Netherlands, and Ukraine in June 2026.

Attack Chain

The infection begins with bogus MSI installers delivered via ClickFix, which trigger a series of actions including delivering a loader called LunexLoader. LunexLoader bypasses User Account Control on Windows using the CMSTPLUA COM object. The malware then leverages a bring your own vulnerable driver attack for defense evasion before downloading the stealer payload. The BYOVD technique is rarely used as a precursor to a final-stage payload like an information stealer.

Malware-as-a-Service Platform

Psychedelic Stealer and LunexStealer refer to the same component of the Lunex MaaS platform. Ontinue threat researcher Rhys Downing explained that 'Psychedelic' is the name of the malware file running on victims' devices, while Lunex is the underlying platform sold to multiple criminal groups. The earliest reference to Lunex in cybersecurity literature dates back to June 2026.