Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Lunex is a malware-as-a-service (MaaS) platform that distributes a component called Psychedelic Stealer through compromised Ukrainian websites. The attack uses ClickFix-style fake Cloudflare CAPTCHA verification pages to trick Ukrainian-speaking users into executing malware. Researchers at Ontinue identified a four-stage attack chain beginning with the fake CAPTCHA page. The malware abuses an AMD driver to disable security monitoring tools, allowing it to operate undetected. Once active, Lunex Stealer harvests browser credentials and other sensitive data. The campaign specifically targets Ukrainian-speaking users, suggesting a geopolitical motivation. The use of legitimate driver abuse (BYOVD technique) indicates a technically sophisticated threat actor. The MaaS model suggests the tooling is available to multiple threat actors beyond the original developers.