Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details LunexStealer MaaS using BYOVD with AMD's PDFWKRNL.sys (CVE-2023-20598) to blind EDR before stealing credentials and crypto wallets.
Ontinue describes a four-stage chain starting with ClickFix fake-CAPTCHA pages injected into compromised Ukrainian websites, delivering MSI loaders that launch LunexLoader, which bypasses UAC via the CMSTPLUA COM object and abuses AMD's vulnerable PDFWKRNL.sys driver (CVE-2023-20598) to blind security processes while leaving them running. LunexStealer harvests credentials from seven Chromium-based browsers, enumerates desktop and browser-extension cryptocurrency wallets, and persists via a Registry Run key, a hidden scheduled task, and a PowerShell-based Chrome Native Messaging Host. 28 active C2 panels across 13 countries indicate rapid expansion of the Russian-speaking-developed MaaS platform. Testing showed neither HVCI nor Microsoft's Vulnerable Driver Blocklist stops this driver variant.
- ClickFix lures on compromised Ukrainian sites deliver fake MSI installers loading LunexLoader
- BYOVD abuse of AMD PDFWKRNL.sys (CVE-2023-20598) blinds EDR without killing processes
- Steals data from 7 Chromium browsers and 9 crypto wallets; survives reboots via Chrome Native Messaging Host
- 28 C2 panels across 13 countries; HVCI and Microsoft driver blocklist fail to block variant
- CVEs
- CVE-2023-20598
- ATT&CK
- T1204.002 User Execution: Malicious FileT1068 Exploitation for Privilege EscalationT1562.001 Impair Defenses: Disable or Modify ToolsT1547.001 Registry Run Keys / Startup FolderT1555.003 Credentials from Web Browsers
- Malware
- Psychedelic Stealer
- Organizations
- OntinueLunexAMDArctic Wolf Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-20598 | An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over… | 7.8 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | account-sams-club.com | Turkey has been found to resolve to five phishing domains - account-sams-club[.]com teamwork-recover-password[.]com namshi-uae[.]com whatsapp |
| domain | ibraq-perfumes.com | ver-password[.]com namshi-uae[.]com whatsappbusineses[.]com ibraq-perfumes[.]com This indicates that the MaaS platform's feature set exten |
| domain | namshi-uae.com | s - account-sams-club[.]com teamwork-recover-password[.]com namshi-uae[.]com whatsappbusineses[.]com ibraq-perfumes[.]com This indicat |
| domain | teamwork-recover-password.com | resolve to five phishing domains - account-sams-club[.]com teamwork-recover-password[.]com namshi-uae[.]com whatsappbusineses[.]com ibraq-perfumes[. |
| domain | whatsappbusineses.com | club[.]com teamwork-recover-password[.]com namshi-uae[.]com whatsappbusineses[.]com ibraq-perfumes[.]com This indicates that the MaaS platfor |
| ipv4 | 193.178.159.128 | xecution, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP to facilitate comprehensive information theft - |
From the original article
4 min read at thehackernews.com
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.