Lunex Stealer used AMD driver to blind security tools

Ontinue said the activity came from Lunex, a malware-as-a-service platform, and used fake Cloudflare-style checks on compromised Ukrainian websites. The report said the campaign was aimed at Ukrainian-speaking users and ended with a command-and-control agent that stole browser passwords, cookies and wallet data.

The infection used fake MSI installers and a loader called LunexLoader. Downing said it used the CMSTPLUA COM object to get around UAC, then loaded a vulnerable AMD Radeon Software driver, PDFWKRNL.sys, to raise privileges and interfere with security tools.

Downing said the later stage relied on a PowerShell script inside the Chrome native-messaging host. He said it could list drives, inspect directories, read and write files, download files and run programmes, while the malware also inserted a malicious Chrome extension with broad permissions.

Arctic Wolf Labs had earlier described Psychedelic Stealer after finding it delivered through iframes on legitimate sites. Ontinue said BlueTeamCoolTeam's Luke Wilkinson had identified six Lunex panels in June 2026, and Ontinue later found 28 panels across 13 countries, some linked to phishing domains.