Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
-
A malware-as-a-service platform known as Lunex is behind the Psychedelic Stealer campaign that has been distributed through compromised Ukrainian websites, according to new research from Ontinue. The operation uses ClickFix-style fake CAPTCHA pages that mimic Cloudflare verification checks to lure Ukrainian-speaking users into running malicious code.
The attack unfolds as a four-stage chain. It begins with a fake CAPTCHA page, after which the infection proceeds through additional stages before the stealer is deployed. One of the notable techniques observed is the abuse of an AMD driver to disable security monitoring on the victim's machine, allowing the malware to operate with less interference.
Once active, the stealer focuses on harvesting browser credentials and other sensitive data from infected systems.
Key points:
- Platform: Lunex malware-as-a-service
- Payload: Psychedelic Stealer
- Initial lure: fake CAPTCHA pages using ClickFix-style Cloudflare verification
- Target: Ukrainian-speaking users via compromised Ukrainian websites
- Notable technique: abuse of an AMD driver to disable security monitoring
- Primary goal: theft of browser credentials
- Attack structure: four-stage chain
At this time, no specific CVE identifiers or vendor advisory numbers have been provided in the source reporting, so defenders should focus on behavioral detection rather than signature-based identification alone.
Source: The Hacker News
Has your organization observed ClickFix-style fake CAPTCHA pages or driver-based defense evasion in recent telemetry?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login