Unmasking Lunex: The Rapid Expansion of a Sophisticated Malware-as-a-Service Platform Targeting Ukraine

The deployment of a BYOVD attack as a precursor to an information stealer is a notable shift in tactics. Typically, such advanced evasion methods are used by Advanced Persistent Threat (APT) groups or ransomware operators who need to remain undetected for long periods. By using the vulnerable AMD driver, the LunexLoader can "blind" security-related processes. Rather than simply terminating antivirus or EDR software—which would likely trigger an immediate alert—the malware zeroes out kernel callbacks. This effectively leaves the security tools running in a hollowed state; they appear to be functioning to the user and the system, but they are no longer receiving the data necessary to detect or block malicious activity.

Ontinue’s testing demonstrated that even modern security features like Hypervisor-Protected Code Integrity (HVCI) and the current Microsoft Vulnerable Driver Blocklist have failed to prevent this specific variant of the AMD driver from loading. This gap in protection persists despite the driver’s hash being catalogued in community-driven projects like LOLDrivers since early 2026. Once the security defenses are neutralized, the path is cleared for the final stage: the deployment of the Psychedelic Stealer payload.

The Psychedelic Stealer is a comprehensive data exfiltration tool designed to strip a victim’s digital life of its most valuable assets. According to Downing, the stealer is capable of extracting credentials and session data from seven different Chromium-based browsers. This includes saved passwords, auto-fill information, and session cookies, the latter of which can be used to bypass multi-factor authentication (MFA) by hijacking active login sessions. Furthermore, the malware targets cryptocurrency wallets, searching for local data that would allow the attackers to drain digital assets.

Beyond simple theft, the malware establishes a persistent presence through a PowerShell-based Native Messaging Host (NMH) installed within the victim’s browser. This NMH operates within the context of the Chrome process, making it incredibly difficult to detect through standard file system scans. Because it is integrated into the browser’s architecture, the host survives the deletion of the original stealer binary, system reboots, and browser restarts. The persistence mechanism is backed by a 13,200-byte PowerShell script embedded in the malware’s data section, which implements the Chrome Native Messaging protocol to facilitate communication between the browser and the local system.

This PowerShell script is not merely for persistence; it supports six distinct file system actions, granting the attackers persistent remote access to the victim’s files. This level of control allows the threat actors to continue monitoring the victim and exfiltrating new data long after the initial infection. To further cement its control, LunexStealer injects a malicious Chrome extension by manipulating the browser’s Secure Preferences. This extension requests extensive permissions, including access to cookies, history, bookmarks, tabs, and proxy settings. It also claims the ability to run scripts on all HTTP and HTTPS URLs, effectively giving the attackers total visibility into every website the victim visits and every interaction they have online.