Lunex Stealer Exploits AMD Driver to Bypass Security and Steal Browser Credentials
Malware-as-a-Service platform targets Ukrainian users with advanced evasion techniques.
1Lunex Stealer Overview
Lunex Stealer is a malware-as-a-service (MaaS) platform distributed via compromised Ukrainian websites. It employs a four-stage attack chain, starting with a fake CAPTCHA page and culminating in the deployment of a command-and-control (C2) agent. The malware targets Ukrainian-speaking users, extracting credentials from Chromium-based browsers, exfiltrating cryptocurrency wallets, and establishing persistent remote filesystem access.
2BYOVD Technique
Lunex Stealer leverages the bring your own vulnerable driver (BYOVD) technique to evade defenses. It exploits a vulnerable kernel-mode driver for AMD Radeon Software ('PDFWKRNL.sys'), susceptible to CVE-2023-20598, to escalate privileges and blind security-related processes. This method is significant as it is rarely used as a precursor to an information stealer payload.
3Infection Mechanism
The infection begins with bogus MSI installers delivered via ClickFix, triggering actions that include delivering LunexLoader. This loader bypasses User Account Control (UAC) on Windows using the CMSTPLUA COM object. The malware then downloads the stealer payload, which communicates with the Lunex panel over HTTP to facilitate comprehensive information theft.
4Persistent Access
LunexStealer maintains persistent access through a PowerShell-based Native Messaging Host installed within the victim's browser. This host operates within Chrome's process context, surviving stealer binary deletion, system reboots, and browser restarts. It implements the Chrome Native Messaging protocol over standard input and output.
5Chrome Extension Manipulation
LunexStealer injects a malicious Chrome extension by manipulating Chrome Secure Preferences. The extension declares extensive permissions, granting complete visibility and control over the victim's browser activity. This includes access to cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs.
6Global Expansion
Analysis of the Lunex panel indicates a Russian-speaking developer or team, with 28 unique panels identified across 13 countries. This marks a major expansion from June 2026, with panels hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh. The platform's rapid growth suggests active use by multiple threat actors.
7Phishing Capabilities
One Lunex panel hosted in Turkey resolves to five phishing domains, indicating the MaaS platform's feature set extends beyond credential theft to enable brand impersonation and phishing. This capability allows threat actors to conduct more sophisticated attacks, leveraging the platform's infrastructure for broader malicious activities.
8Security Implications
The BYOVD delivery chain represents a quieter approach to EDR neutralization, leaving security products running but blind. Testing validated that neither HVCI nor the Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading. This gap persists despite the driver hash being catalogued in the LOLDrivers project since March 2026.