Security researchers have uncovered a sophisticated attack chain deployed by the Lunex malware-as-a-service platform (also called Psychedelic Stealer) that leverages a vulnerable AMD driver to disable security tools and siphon off browser-stored data. The assault, targeting users who speak Ukrainian, unfolds through a multi-stage scheme combining browser credential theft, wallet hijacking and hidden persistence mechanisms.
Attack Pipeline: From Phishing to Full-System Compromise
The campaign begins when victims visit compromised Ukrainian websites that display fake CAPTCHA-style security checks, using techniques similar to ClickFix verification. These lure victims into downloading malicious MSI installers that embed a chain of payloads. First comes LunexLoader, designed to bypass User Account Control mechanisms through the COM object named CMSTPLUA. Next, the malware uses a “bring-your-own vulnerable driver” (BYOVD) approach, exploiting the kernel-mode driver PDFWKRNL.sys associated with AMD Radeon Software. This driver is subject to a known vulnerability (CVE-2023-20598) that allows privilege escalation and effectively blinds security monitoring processes without terminating them.
Stealing Credentials, Wallets, and Hiding in Plain Sight
Once security tools are neutralized, the attack delivers the main stealer payload. The malware harvests passwords and browsing data from multiple Chromium-based browsers, including Chrome, Edge, Brave, Yandex, Opera, Opera GX, and Vivaldi. It also extracts data from both browser extensions like MetaMask, OKX Wallet, SafePal, and legacy MetaMask, as well as from desktop cryptocurrency wallets including Electrum, Exodus, Atomic Wallet, Bitcoin Core, and Litecoin.
To remain installed and survive reboots or browser restarts, the attack implements several persistence mechanisms: it adds entries to the Windows Registry, sets up a hidden scheduled task (named “psychedelicloveUtils”), and installs a native messaging host (NMH) inside Chrome. This NMH is backed by a PowerShell script embedded directly inside the malware file, allowing remote file operations (read, write, download, run) through the browser process. The malware further inserts an extension into Chrome by modifying secure preferences, granting the extension sweeping browser access over cookies, history, bookmarks, tabs, and more.
Spread, Attribution, and Global Reach
The Lunex platform has grown rapidly since its first documented use in June 2026, when active command-and-control (C2) panels were detected in Finland, Germany, the Netherlands, Ukraine, and the U.S. As of the latest analysis, 28 panels have been identified across 13 countries, including Turkey, Bangladesh, the UK, France, and Germany. One panel alone was found operating through five different phishing domains, indicating capability not just for credential theft but also for phishing-based brand impersonation.
Analysis of log data and monitoring points to a Russian-language development background. The acceleration in deployment and wide geographic diffusion suggest Lunex is operating either as a large single group or sold to multiple cybercriminal actors.
Ontinue researchers also note that current defenses fall short. The specific variant of the vulnerable driver used in these attacks bypasses protections offered by Microsoft’s Vulnerable Driver Blocklist and HVCI (Hypervisor-protected Code Integrity). Although the driver hash was included in the LOLDrivers project as of March 2026, it continues to load on victim systems, making this attack route persist despite known mitigations.
What to Watch and Defend
Organizations and individuals need to monitor for signs of BYOVD exploit chains, especially involving PDFWKRNL.sys or suspicious MSI installers. Browser-based native messaging hosts, unexpected scheduled tasks, or browser extensions with excessive privileges should all raise red flags. Ensuring AMD driver versions are patched, applying kernel driver blocklists, and using endpoint security tools that don’t solely rely on process termination are becoming critical in defending against this evolving threat.
Analysis: This campaign demonstrates how stealth and persistence are increasingly driven by techniques that subvert trusted system components rather than brute-forcing their removal. Lunex’s use of a legitimate, vulnerable driver to evade detection and maintain long-term access underlines a growing trend in modern malware toward leveraging “living-off-the-land” tools. Going forward, defenders must do more than simply update signatures—they’ll need to audit driver trust, enforce code integrity, and assume that even running processes might be compromised.
