Unmasking Lunex: The Rapid Expansion of a Sophisticated Malware-as-a-Service Platform Targeting Ukraine

The infrastructure supporting this activity points to a robust and expanding criminal enterprise. While "Psychedelic Stealer" is the name often seen in the filenames on victim devices, it is merely a component of the broader Lunex MaaS platform. The platform is being sold to various criminal groups, which explains the proliferation of different command-and-control panels across the globe. Earlier documentation from June 2026 by researchers at BlueTeamCoolTeam identified six active C2 panels. However, recent analysis shows a massive expansion, with 28 unique panels now identified across 13 countries, including Russia, the United States, the United Kingdom, Germany, and Turkey.

The growth of the platform in just a few months suggests that Lunex is finding a ready market among cybercriminals. Analysis of the C2 panels and the underlying code indicates that the developers are likely Russian-speaking. One specific panel hosted in Turkey was found to resolve to five different phishing domains, suggesting that the MaaS platform’s feature set is diversifying. It is no longer just about stealing credentials; it is evolving into a full-service suite for brand impersonation and targeted phishing campaigns.

The targeting of Ukrainian-speaking users and the compromise of legitimate Ukrainian web infrastructure suggest a focused effort by the operators or their affiliates to exploit the current regional context. By compromising local businesses and services, the attackers benefit from a level of trust that makes their social engineering lures much more convincing.

In his communication with The Hacker News, Downing emphasized that the BYOVD delivery chain represents a "quieter approach to EDR neutralization." By leaving security products running but blind, the attackers can operate with a high degree of confidence that their activities will not be interrupted. This tactical evolution poses a significant challenge for defenders, as it bypasses many of the traditional signals used to identify a compromise.

As the Lunex platform continues to expand, the cybersecurity community is urged to look beyond simple file signatures and focus on the behavioral patterns of the infection chain, such as the unauthorized loading of vulnerable drivers and the manipulation of browser messaging hosts. The persistence and sophistication of the Psychedelic Stealer serve as a stark reminder that even "standard" malware is increasingly adopting the advanced techniques once exclusive to the world’s most elite hacking groups. The expansion of Lunex into a global threat underscores the necessity for updated blocklists and more robust kernel-level protections to counter the growing trend of BYOVD-assisted attacks.