The attack unfolds as a four-stage chain. It begins with a fake CAPTCHA page, after which the infection proceeds through additional stages before the stealer is deployed. One of the notable techniques observed is the abuse of an AMD driver to disable security monitoring on the victim's machine, allowing the malware to operate with less interference.

Once active, the stealer focuses on harvesting browser credentials and other sensitive data from infected systems.

Key points:

• Platform: Lunex malware-as-a-service
• Payload: Psychedelic Stealer
• Initial lure: fake CAPTCHA pages using ClickFix-style Cloudflare verification
• Target: Ukrainian-speaking users via compromised Ukrainian websites
• Notable technique: abuse of an AMD driver to disable security monitoring
• Primary goal: theft of browser credentials
• Attack structure: four-stage chain

At this time, no specific CVE identifiers or vendor advisory numbers have been provided in the source reporting, so defenders should focus on behavioral detection rather than signature-based identification alone.

Source: The Hacker News

Has your organization observed ClickFix-style fake CAPTCHA pages or driver-based defense evasion in recent telemetry?