Unmasking Lunex: The Rapid Expansion of a Sophisticated Malware-as-a-Service Platform Targeting Ukraine

The cybersecurity landscape is witnessing the emergence of a highly sophisticated Malware-as-a-Service (MaaS) platform known as Lunex, which has recently been identified as the engine behind a series of targeted attacks against Ukrainian users. According to new research, the platform is being used to deploy a potent information-stealing component dubbed "Psychedelic Stealer." The operation utilizes a complex, multi-stage infection chain that leverages compromised legitimate websites, social engineering lures, and advanced evasion techniques—including the exploitation of vulnerable kernel-mode drivers—to bypass modern security defenses and maintain a persistent foothold on victim systems.

The discovery of this activity comes from the threat intelligence firm Ontinue, which recently published a detailed technical analysis of the Lunex ecosystem. Researchers described the campaign as a meticulously orchestrated four-stage attack chain designed to deceive users and neutralize Endpoint Detection and Response (EDR) solutions before the final payload is ever delivered. This methodical approach highlights a growing trend in the cybercriminal underworld where traditionally "noisy" malware, such as information stealers, is being paired with sophisticated delivery mechanisms usually reserved for high-level espionage or ransomware operations.

The initial point of compromise typically involves legitimate Ukrainian websites that have been breached by threat actors. These sites—ranging from those of hair-treatment clinics and scale-model manufacturers to tool retailers and psychological facilities—are injected with malicious iframe elements. These iframes serve a "ClickFix" style lure, a social engineering tactic that mimics legitimate browser or security verification checks. Specifically, users are presented with a fake CAPTCHA or a fraudulent Cloudflare verification page. These pages are designed to trick the visitor into performing an action, such as downloading and running a file, under the guise of proving they are not a bot.

Rhys Downing, a threat researcher at Ontinue, noted that the attack chain begins with this fake CAPTCHA page and culminates in the deployment of a fully-featured command-and-control (C2) agent. Once a user is lured into interacting with the fraudulent page, they are typically prompted to download a bogus MSI installer. This installer acts as the gateway for the subsequent stages of the infection. The use of the ClickFix lure is particularly effective because it capitalizes on the habitual nature of web browsing, where users are accustomed to seeing and interacting with verification prompts to access content.

The second stage of the attack involves a loader known as LunexLoader. This component is responsible for preparing the victim’s environment for the stealer and ensuring that the malware can operate with the necessary permissions. To achieve this, LunexLoader utilizes a sophisticated bypass for Windows User Account Control (UAC). By leveraging the CMSTPLUA COM object—a well-known but still effective technique for privilege escalation—the loader can execute commands with elevated rights without triggering the standard Windows prompt that would otherwise alert a vigilant user.

Perhaps the most significant aspect of the Lunex infection chain is its use of a "Bring Your Own Vulnerable Driver" (BYOVD) attack for defense evasion. This technique involves the malware purposely installing a legitimate but known-vulnerable kernel-mode driver onto the victim’s system. In this specific campaign, Lunex takes advantage of an AMD Radeon Software driver, identified as "PDFWKRNL.sys." This driver is susceptible to CVE-2023-20598, a vulnerability that allows for privilege escalation and the manipulation of system processes at the kernel level.

The deployment of a BYOVD attack as a precursor to an information stealer is a notable shift in tactics. Typically, such advanced evasion methods are used by Advanced Persistent Threat (APT) groups or ransomware operators who need to remain undetected for long periods. By using the vulnerable AMD driver, the LunexLoader can "blind" security-related processes. Rather than simply terminating antivirus or EDR software—which would likely trigger an immediate alert—the malware zeroes out kernel callbacks. This effectively leaves the security tools running in a hollowed state; they appear to be functioning to the user and the system, but they are no longer receiving the data necessary to detect or block malicious activity.

Ontinue’s testing demonstrated that even modern security features like Hypervisor-Protected Code Integrity (HVCI) and the current Microsoft Vulnerable Driver Blocklist have failed to prevent this specific variant of the AMD driver from loading. This gap in protection persists despite the driver’s hash being catalogued in community-driven projects like LOLDrivers since early 2026. Once the security defenses are neutralized, the path is cleared for the final stage: the deployment of the Psychedelic Stealer payload.

The Psychedelic Stealer is a comprehensive data exfiltration tool designed to strip a victim’s digital life of its most valuable assets. According to Downing, the stealer is capable of extracting credentials and session data from seven different Chromium-based browsers. This includes saved passwords, auto-fill information, and session cookies, the latter of which can be used to bypass multi-factor authentication (MFA) by hijacking active login sessions. Furthermore, the malware targets cryptocurrency wallets, searching for local data that would allow the attackers to drain digital assets.

Beyond simple theft, the malware establishes a persistent presence through a PowerShell-based Native Messaging Host (NMH) installed within the victim’s browser. This NMH operates within the context of the Chrome process, making it incredibly difficult to detect through standard file system scans. Because it is integrated into the browser’s architecture, the host survives the deletion of the original stealer binary, system reboots, and browser restarts. The persistence mechanism is backed by a 13,200-byte PowerShell script embedded in the malware’s data section, which implements the Chrome Native Messaging protocol to facilitate communication between the browser and the local system.

This PowerShell script is not merely for persistence; it supports six distinct file system actions, granting the attackers persistent remote access to the victim’s files. This level of control allows the threat actors to continue monitoring the victim and exfiltrating new data long after the initial infection. To further cement its control, LunexStealer injects a malicious Chrome extension by manipulating the browser’s Secure Preferences. This extension requests extensive permissions, including access to cookies, history, bookmarks, tabs, and proxy settings. It also claims the ability to run scripts on all HTTP and HTTPS URLs, effectively giving the attackers total visibility into every website the victim visits and every interaction they have online.

The infrastructure supporting this activity points to a robust and expanding criminal enterprise. While "Psychedelic Stealer" is the name often seen in the filenames on victim devices, it is merely a component of the broader Lunex MaaS platform. The platform is being sold to various criminal groups, which explains the proliferation of different command-and-control panels across the globe. Earlier documentation from June 2026 by researchers at BlueTeamCoolTeam identified six active C2 panels. However, recent analysis shows a massive expansion, with 28 unique panels now identified across 13 countries, including Russia, the United States, the United Kingdom, Germany, and Turkey.

The growth of the platform in just a few months suggests that Lunex is finding a ready market among cybercriminals. Analysis of the C2 panels and the underlying code indicates that the developers are likely Russian-speaking. One specific panel hosted in Turkey was found to resolve to five different phishing domains, suggesting that the MaaS platform’s feature set is diversifying. It is no longer just about stealing credentials; it is evolving into a full-service suite for brand impersonation and targeted phishing campaigns.

The targeting of Ukrainian-speaking users and the compromise of legitimate Ukrainian web infrastructure suggest a focused effort by the operators or their affiliates to exploit the current regional context. By compromising local businesses and services, the attackers benefit from a level of trust that makes their social engineering lures much more convincing.

In his communication with The Hacker News, Downing emphasized that the BYOVD delivery chain represents a "quieter approach to EDR neutralization." By leaving security products running but blind, the attackers can operate with a high degree of confidence that their activities will not be interrupted. This tactical evolution poses a significant challenge for defenders, as it bypasses many of the traditional signals used to identify a compromise.

As the Lunex platform continues to expand, the cybersecurity community is urged to look beyond simple file signatures and focus on the behavioral patterns of the infection chain, such as the unauthorized loading of vulnerable drivers and the manipulation of browser messaging hosts. The persistence and sophistication of the Psychedelic Stealer serve as a stark reminder that even "standard" malware is increasingly adopting the advanced techniques once exclusive to the world’s most elite hacking groups. The expansion of Lunex into a global threat underscores the necessity for updated blocklists and more robust kernel-level protections to counter the growing trend of BYOVD-assisted attacks.