Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Researchers at Ontinue have detailed Lunex, a malware-as-a-service platform behind Psychedelic Stealer, which was recently seen spreading through compromised Ukrainian websites via fake CAPTCHA/ClickFix lures. After a bogus MSI installer bypasses Windows User Account Control, a loader called LunexLoader exploits a known flaw (CVE-2023-20598) in the legitimate but vulnerable AMD Radeon Software driver PDFWKRNL.sys to silently zero out kernel callbacks and blind security products without killing them, in a classic bring-your-own-vulnerable-driver (BYOVD) maneuver. Once defenses are neutralized, the stealer harvests credentials, session cookies and data from seven Chromium-based browsers, targets nine cryptocurrency wallet types, and installs a PowerShell-driven Chrome Native Messaging Host that grants attackers persistent remote file-system access surviving reboots and reinstalls. Notably, this AMD driver flaw still isn't blocked by HVCI or Microsoft's Vulnerable Driver Blocklist, even though the driver has been listed in the LOLDrivers catalog since March 2026, and researchers have tracked 28 Lunex panels across 13 countries, suggesting the platform is actively growing and shared among multiple criminal groups, likely Russian-speaking.