# Lunex Stealer Exploits AMD Driver to Bypass Security and Steal Browser Credentials Malware-as-a-Service platform targets Ukrainian users with advanced evasion techniques. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-26 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3f846986-184c-4000-ae68-85b09cb5fa1c ## Lunex Stealer Overview Lunex Stealer is a malware-as-a-service (MaaS) platform distributed via compromised Ukrainian websites. It employs a four-stage attack chain, starting with a fake CAPTCHA page and culminating in the deployment of a command-and-control (C2) agent. The malware targets Ukrainian-speaking users, extracting credentials from Chromium-based browsers, exfiltrating cryptocurrency wallets, and establishing persistent remote filesystem access. ## BYOVD Technique Lunex Stealer leverages the bring your own vulnerable driver (BYOVD) technique to evade defenses. It exploits a vulnerable kernel-mode driver for AMD Radeon Software ('PDFWKRNL.sys'), susceptible to CVE-2023-20598, to escalate privileges and blind security-related processes. This method is significant as it is rarely used as a precursor to an information stealer payload. ## Infection Mechanism The infection begins with bogus MSI installers delivered via ClickFix, triggering actions that include delivering LunexLoader. This loader bypasses User Account Control (UAC) on Windows using the CMSTPLUA COM object. The malware then downloads the stealer payload, which communicates with the Lunex panel over HTTP to facilitate comprehensive information theft. ## Persistent Access LunexStealer maintains persistent access through a PowerShell-based Native Messaging Host installed within the victim's browser. This host operates within Chrome's process context, surviving stealer binary deletion, system reboots, and browser restarts. It implements the Chrome Native Messaging protocol over standard input and output. ## Chrome Extension Manipulation LunexStealer injects a malicious Chrome extension by manipulating Chrome Secure Preferences. The extension declares extensive permissions, granting complete visibility and control over the victim's browser activity. This includes access to cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs. ## Global Expansion Analysis of the Lunex panel indicates a Russian-speaking developer or team, with 28 unique panels identified across 13 countries. This marks a major expansion from June 2026, with panels hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh. The platform's rapid growth suggests active use by multiple threat actors. ## Phishing Capabilities One Lunex panel hosted in Turkey resolves to five phishing domains, indicating the MaaS platform's feature set extends beyond credential theft to enable brand impersonation and phishing. This capability allows threat actors to conduct more sophisticated attacks, leveraging the platform's infrastructure for broader malicious activities. ## Security Implications The BYOVD delivery chain represents a quieter approach to EDR neutralization, leaving security products running but blind. Testing validated that neither HVCI nor the Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading. This gap persists despite the driver hash being catalogued in the LOLDrivers project since March 2026. ## Sources covering this story - https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._