Lunex Stealer is a useful reminder that information-stealing malware is becoming more operationally mature. According to reporting from The Hacker News, researchers at Ontinue linked the recently discussed Psychedelic Stealer activity to a broader malware-as-a-service platform called Lunex. The campaign targets Ukrainian-speaking users through compromised legitimate websites and fake Cloudflare-style verification pages, then moves through a multi-stage Windows infection chain before stealing browser credentials, cookies, cryptocurrency wallet data, and files.

The detail that should get security teams' attention is not only the theft capability. It is the way Lunex attempts to weaken endpoint defenses first. The loader reportedly uses a bring-your-own-vulnerable-driver technique against a vulnerable AMD Radeon Software kernel driver, PDFWKRNL.sys, associated with CVE-2023-20598. Instead of simply killing security tools, the malware aims to interfere with monitoring while leaving products apparently running. That makes the incident harder for users and responders to notice.

What makes this campaign notable

Many infostealer incidents follow a familiar pattern: a lure, a downloaded executable, browser data theft, and rapid exfiltration. Lunex adds several layers that make the campaign more concerning for defenders.

First, the distribution method abuses trust. The campaign has been observed using compromised Ukrainian websites and ClickFix-style fake CAPTCHA prompts. These lures pressure users to perform actions that feel like routine verification, but actually lead toward malicious installer execution. Because the initial page can appear on a legitimate site, standard user suspicion may be lower than it would be for an obvious phishing domain.

Second, the loader reportedly attempts Windows User Account Control bypass using the CMSTPLUA COM object. That step helps the malware move from user-assisted execution toward a more privileged position on the endpoint.

Third, the BYOVD component gives the attacker a kernel-adjacent defense evasion path. Vulnerable signed drivers remain valuable to attackers because they can be loaded on systems that would otherwise block unsigned kernel code. If successful, this can let malware tamper with security telemetry and callbacks at a level that ordinary user-mode tools cannot easily inspect.

Finally, Lunex is not only a one-time credential grabber. Ontinue reported persistence through a Registry Run key, a hidden scheduled task named psychedelicloveUtils, and a browser native-messaging host backed by PowerShell. That native-messaging bridge can continue to support file-system actions such as listing drives, reading files, writing files, downloading data, and running programs.

Browser data is still the primary target

LunexStealer reportedly targets several Chromium-based browsers, including Chrome, Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi. The goal is predictable but high-impact: credentials, session cookies, and other browser-stored secrets.

For businesses, stolen cookies can be as damaging as stolen passwords. If an attacker obtains valid session material, they may be able to bypass normal login prompts and, in some cases, reduce the effectiveness of multi-factor authentication. That is why incident response for infostealers should include session revocation, not just password resets.

The malware also enumerates cryptocurrency wallets and browser wallet extensions. That expands the impact from corporate account compromise to direct financial theft, especially on endpoints used for both work and personal activity.

Defensive priorities for security teams

Organizations should treat this type of campaign as both an endpoint defense issue and an identity security issue. The following controls are practical starting points:

- Review exposure to vulnerable drivers. Use endpoint management and EDR inventory to look for PDFWKRNL.sys and other known abused drivers. Driver allowlisting, vulnerable driver block policies, and firmware/driver hygiene should be part of routine endpoint hardening.
- Monitor for suspicious native-messaging hosts. Browser native-messaging configuration is powerful and often overlooked. Unexpected Chrome native-messaging hosts, especially those linked to PowerShell or unusual user-profile paths, deserve immediate review.
- Hunt for ClickFix-style execution chains. Look for user-driven commands copied from web pages, suspicious MSI execution, unexpected PowerShell activity, and downloads following fake verification pages.
- Reset credentials and revoke sessions after suspected infection. Password changes alone are not enough when cookies or tokens may have been stolen. Force sign-out across identity providers, SaaS platforms, and browser-synced accounts.
- Watch persistence locations. Registry Run keys and scheduled tasks remain common because they work. Hidden or oddly named tasks, including names resembling psychedelicloveUtils, should be investigated.
- Segment personal crypto activity from work endpoints. Wallet extensions and seed material should not exist on machines used for routine browsing, email, and business administration.

What users should do

Users should be cautious of websites that ask them to copy commands, run installers, or complete unusual verification steps. Real CAPTCHA checks do not require running Windows installers or pasting commands into terminals. If a page claims that Cloudflare or another anti-bot system requires manual installation, close it and report the site.

If a user believes they executed a suspicious installer, the right response is to disconnect the machine from the network, preserve it for investigation, and use a separate trusted device to change important passwords. For business accounts, administrators should revoke active sessions and inspect recent login activity.

Why this matters

Lunex shows the continued professionalization of infostealer operations. A malware-as-a-service platform with fake verification lures, privilege escalation, driver-based defense evasion, credential theft, wallet targeting, browser persistence, and phishing infrastructure is not a simple nuisance infection. It is a full compromise path that can lead to account takeover, financial theft, and follow-on intrusions.

The main lesson is clear: endpoint security cannot focus only on detecting final payloads. Defenders need visibility into the earlier chain, including browser abuse, suspicious installers, vulnerable driver loading, and identity artifacts stolen from browsers.

Source: The Hacker News source