Summary:

Researchershave analysed a four-stage attack chain tied to the Lunex Malware-as-a-Serviceplatform, targeting Ukrainian-speaking users through a fake CAPTCHA lure thattricks victims into running an msiexec command.

Thechain silently installs an MSI and deploys a loader that escalates privilegesand abuses the vulnerable AMD driver PDFWKRNL.sys (CVE-2023-20598) to zero thekernel callbacks of 20 security drivers. It then downloads LunexStealer, whichsteals credentials and cookies from seven Chromium browsers, exfiltratescryptocurrency wallets, and installs a PowerShell-based Native Messaging Hostthat provides attackers with persistent filesystem access even after thestealer is deleted.

Internet-widescanning identified 28 Lunex panels across 13 countries. The platform appearsto have been developed by Russian-speaking developers and sold to multiplecriminal operators.

Technical Description:

LunexStealer is delivered through a four-stage attack chain involving a MinGW-w64 loader that conceals its strings using AES-256 encryption, inflates its import table with decoy APIs, and impersonates a nonexistent product called "Update Manager."

The loader disguises its process, uses the CMSTPLUA auto-elevating COM object to obtain administrator privileges without triggering a UAC prompt, and downloads kernel symbols from Microsoft's symbol server to resolve callback offsets for the running Windows build. It then loads the modified but still loadable AMD PDFWKRNL.sys driver, which exposes unrestricted kernel read and write IOCTLs, and zeroes callback entries belonging to Microsoft Defender, Kaspersky, Dr.Web, ESET, Elastic, CrowdStrike, SentinelOne, Sysmon and the Windows Filter Manager.

The final stealer uses FNV-1a API hashing and direct syscalls to harvest credentials, cookies and payment data from seven Chromium browsers, supporting v10, v11 and v20 encryption formats. It also steals data from five desktop wallets and four browser extension wallets, injects a malicious Chrome extension, and communicates with an HTTP API-key-authenticated panel.

Persistence is maintained through a Run key, a hidden scheduled task, and a Native Messaging Host registry key backed by a PowerShell script. The script provides capabilities for drive listing, file reading and writing, downloading, and program execution. The attack chain and its technical components are discussed in greater detail below.

Delivery and Infection Chain:

Victims encounter a Ukrainian-language fake CAPTCHA page hosted on uasputnik[.]com, which instructs them to execute an msiexec command. The command silently installs elita.msi from an attacker-controlled URL.

The MSI presents itself as "Vertification" by "Internal Software," suppresses the installer wizard, hides its Add/Remove Programs options, requires no administrator privileges, and installs to a per-user directory under %LOCALAPPDATA%. Its Upgrade table allows operators to distribute updated payloads to previously compromised systems.

The reported infection chain can be summarised as follows:

• The victim visits the fake CAPTCHA page and executes the supplied msiexec command.
• The MSI (elita.msi) installs silently and automatically launches the loader through a Custom Action.
• The loader (psychedelic.exe / config.exe) masquerades as a Windows binary and performs VM and sandbox checks.
• It elevates its privileges to administrator through the CMSTPLUA COM elevation moniker without triggering a UAC prompt.
• It downloads ntkrnlmp.pdb from Microsoft's symbol server to resolve kernel offsets for the running Windows build.
• It decrypts, installs and loads the PDFWKRNL.sys driver, then zeroes callback entries belonging to the 20 targeted security drivers.
• It downloads LunexStealer (psychedeliclove.exe) from the payload server.
• The stealer establishes persistence, steals credentials and wallets, and exfiltrates data to the Lunex panel over HTTP.
• The Native Messaging Host maintains remote filesystem access even if the stealer is removed.

Technical Capabilities:

LunexStealer is a 64-bit MinGW-w64 C2 agent capable of retrieving stored login credentials, cookies, credit card information and autofill data from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi.

It supports Chrome v10, v11 (App-Bound Encryption via injected COM shellcode) and v20 (ChaCha20-Poly1305) encryption formats. It also uses a custom SQLite B-tree parser to avoid library dependencies.

The malware steals data from Bitcoin Core, Litecoin, Exodus, Atomic Wallet and Electrum, as well as MetaMask, MetaMask Legacy, OKX Wallet and SafePal browser extensions. It injects a malicious Chrome extension by bypassing Secure Preferences integrity checks and evades EDR detection through direct syscalls and hash-based API resolution.

Additional capabilities include remote task polling, a kill switch and dynamic configuration updates.

Attribution and Evolution:

The campaign has not been attributed to a named threat group. Researchers assess with confidence that Lunex was developed by a Russian-speaking developer or team and is sold to multiple independent, financially motivated operators.

Supporting evidence includes more than 150 Russian UI strings used as the default locale, a "ya.ru" placeholder, and a blocklist targeting Russian and CIS antivirus products.

The Chrome Secure Preferences bypass was initially considered a potential link to APT31's SUPERSTOMP, but this association was subsequently downgraded because the technique has proliferated across unrelated operations. Earlier OSINT research documented a Rust-based stealer, whereas the analysed sample is C-based, indicating that multiple codebases share a common panel architecture.

Active Campaign and Geographic Spread:

The analysed stealer was compiled on September 12, 2026, and both C2 servers were confirmed to be active on September 15, 2026. The campaign targets Ukrainian-speaking users.

Internet-wide scanning identified 28 Lunex panels across 13 countries, an increase from the six panels documented in June 2026. Russia hosts the highest number of identified panels (6), followed by the United States (4), the United Kingdom (3), and the Netherlands, France, Germany, Turkey and Bangladesh (2 each).

One Turkey-based panel resolves to five phishing domains impersonating brands such as Sam's Club, WhatsApp, and Namshi, indicating separate operators with different targeting objectives.

Conclusion:

Lunex is more than an information-stealing platform. It is a full-featured crimeware platform offering web inject management, browser spoofing, remote browser control and persistent filesystem access.

It demonstrates how commodity malware increasingly incorporates sophisticated EDR-blinding techniques, using Bring Your Own Vulnerable Driver (BYOVD) attacks and PDB-guided callback zeroing before deploying an information stealer.

Testing revealed that the particular driver variant used in this campaign was not blocked by either HVCI or the current Microsoft Vulnerable Driver Blocklist. Defenders should therefore include the Native Messaging Host registry key in their remediation efforts and focus detection on the attack stages that occur before EDR visibility is impaired.

Impact:

Successful compromise exposes browser credentials, session cookies, payment data and cryptocurrency wallets, potentially leading to account takeover, financial loss and subsequent fraud.

By zeroing kernel callbacks, the malware leaves security products running while impairing their visibility, delaying detection. The Native Messaging Host provides attackers with persistent filesystem access and program execution capabilities. Consequently, removing only the stealer binary does not fully remediate the compromise.

IOC and Context Details:

Recommended Actions:

• Hunt for the Native Messaging Host registry keys HKCU\Software\Google\Chrome\NativeMessagingHosts\com.lunex.explorer and the matching Microsoft Edge key, and include them in remediation scope alongside the stealer binary, scheduled task and Run key.
• Block or monitor connections to the identified infrastructure, including uasputnik[.]com, 107.175.82[.]242, 193.178.159[.]128, and the listed phishing domains, and search DNS, proxy and firewall logs for historical hits.
• Detect and alert on the stages before EDR blindness, including msiexec installs from remote URLs, kernel symbol (PDB) downloads by non-development processes, driver drops to temporary directories, and service creation for drivers from non-standard paths.
• Block the vulnerable PDFWKRNL.sys driver using hash-based application control or WDAC rules, since HVCI and the Microsoft Vulnerable Driver Blocklist did not stop this variant, and monitor for the \.\PdFwKrnl device path.
• Educate users to never run msiexec, terminal or Run dialog commands from CAPTCHA or verification web pages, and report such pages for takedown.
• Monitor for the creation of the hidden scheduled task psychedelicloveUtils, the Run key value using the "UserStarts" format, and the mutex Local\psychedeliclove-guard on endpoints.
• Audit browsers for unauthorized extensions, Secure Preferences tampering and developer mode being enabled, and monitor for browser processes being terminated with taskkill followed by wd_tmp.db creation.
• Rotate credentials, revoke session tokens and move cryptocurrency assets from any suspected compromised system, enforce multi-factor authentication, and investigate DLL, COM elevation and suspended browser child process injection activity in EDR telemetry.

Reference:

https://www.ontinue.com/resource/lunex-unmasked-a-new-information-stealer-deployed-through-byovd/