Date: September 26, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Windows Endpoint Security / Kernel Exploitation & BYOVD / Malware Analysis
Tags: Lunex Stealer, Psychedelic Stealer, BYOVD, AMD Driver, CVE-2023-20598, Native Messaging Host, EDR Blinding
Executive Summary
On September 26, 2026, managed security and threat research firm Ontinue published a technical investigation uncovering Lunex, an expanding, modular Malware-as-a-Service (MaaS) platform currently targeting enterprise and consumer endpoints. As reported by The Hacker News, the platform distributes an infostealer payload codenamed Psychedelic Stealer (or LunexStealer) through sophisticated four-stage attack chains initiated via ClickFix social engineering lures.
What elevates Lunex far above typical commodity infostealers is its advanced endpoint defense evasion and stealth persistence architecture. To neutralize Endpoint Detection and Response (EDR) software, Lunex executes a Bring Your Own Vulnerable Driver (BYOVD) attack using an officially signed AMD Radeon kernel driver (PDFWKRNL.sys, vulnerable to CVE-2023-20598). Rather than aggressively terminating EDR processes—which immediately trips watchdog alarms and tamper protection—Lunex operates silently in Ring 0, zeroing out kernel telemetry callbacks. The EDR agents appear perfectly healthy to SOC consoles while being rendered completely blind.
Once security monitoring is blinded, Lunex establishes an ingenious, ultra-resilient persistence mechanism by registering a PowerShell-backed Chrome Native Messaging Host (NMH). Running directly inside the browser's process tree, the persistent bridge survives executable file deletion, reboots, and browser updates, enabling remote operators to execute filesystem operations and harvest credentials from seven Chromium browsers and nine cryptocurrency wallets.
Technical Deep-Dive: Deconstructing the Lunex Four-Stage Infection Chain
The Lunex infection sequence demonstrates a calculated progression from user-mode social engineering to Ring 0 kernel manipulation, culminating in browser-level living-off-the-land persistence:+-----------------------------------------------------------------------------------+
| LUNEX STEALER INFECTION ARCHITECTURE |
|---|
Victim (Web Browser)
|
| 1. Compromised Website serves ClickFix Lure (Fake Cloudflare CAPTCHA)
| [Pastejacking copies malicious PowerShell / MSI installer URL]
v
Victim Workstation (User-Mode Execution)
|
| 2. Executes Malicious MSI Installer:
| - Spawns `LunexLoader`
| - Bypasses UAC via `CMSTPLUA` COM Object (Auto-Elevates to High Integrity)
|
| 3. [STAGE 1: BYOVD EDR BLINDING]
| - Drops signed AMD driver: `PDFWKRNL.sys` (CVE-2023-20598)
| - Bypasses HVCI & Microsoft Vulnerable Driver Blocklist!
| - Exploits arbitrary kernel read/write primitive:
| * Locates `PspCreateProcessNotifyRoutine` array
| * Locates `PspCreateThreadNotifyRoutine` array
| * Locates `ObRegisterCallbacks` table
| * Zeroes out callback function pointers in kernel memory!
| - EDR processes remain running, but RECEIVE ZERO KERNEL TELEMETRY!
|
| 4. [STAGE 2: STEALER DETONATION (PSYCHEDELIC)]
| - Dumps master keys & SQLite databases across 7 Browsers:
| Chrome, Edge, Brave, Yandex, Opera, Opera GX, Vivaldi
| - Harvests 5 Desktop Wallets (Bitcoin Core, Exodus, Electrum, etc.)
| - Extracts 4 Browser Wallet Extensions (MetaMask, OKX, SafePal)
| - Exfiltrates data over HTTP to C2: `193.178.159[.]128`
|
| 5. [STAGE 3: CHROME NATIVE MESSAGING HOST (NMH) PERSISTENCE]
| - Registers NMH in Windows Registry under `HKCU\Software\Google\Chrome\...`
| - Drops 13.2 KB PowerShell script embedded in `.rdata` section
| - Operates inside Chrome process context (survives malware deletion!)
| - Backdoor capabilities: `list_dir`, `read_file`, `write`, `download`, `run`
1. Delivery & Silent Privilege Escalation via CMSTPLUA
The infection originates through the pervasive ClickFix technique. Threat actors compromise legitimate web properties (including medical clinics, retailers, and publishing sites) to inject an iframe displaying a fake Cloudflare or Google verification check. The victim is instructed to press Windows Key + R, paste a clipboard string, and hit Enter.
The executed script launches a rogue Windows Installer package containing LunexLoader. To bypass Windows User Account Control (UAC) without triggering confirmation popups, LunexLoader exploits the CMSTPLUA COM interface (GUID {3E5FC7F9-9751-43E1-897C-5DE9E5FE7603}). Because this COM object is configured with auto-elevation properties in Windows system libraries, the malware spawns a secondary high-integrity process silently.
2. Ring 0 Defense Evasion: The AMD BYOVD Attack
To prevent detection by enterprise EDR agents (CrowdStrike, Defender for Endpoint, SentinelOne), Lunex drops and loads a legitimately signed AMD driver:
* File Name: PDFWKRNL.sys
* Vulnerability: CVE-2023-20598 (Arbitrary Physical/Virtual Memory Read/Write via IOCTL)
* Driver Cataloging: Documented in the open-source LOLDrivers project since March 2026.
The Failure of Driver Blocklists: Ontinue’s laboratory validation confirmed that neither Windows Hypervisor-Protected Code Integrity (HVCI) nor Microsoft’s default Vulnerable Driver Blocklist prevented PDFWKRNL.sys from loading.
Kernel Telemetry Callback Zeroing:
Traditional malware attempts to terminate security processes (taskkill /F /IM edr_agent.exe), which triggers instant tamper-protection alerts in the SOC. Lunex employs a far stealthier technique:
1. Using the driver's memory read/write primitive, the loader walks the Windows Kernel (ntoskrnl.exe) image base.
2. It locates the internal kernel callback arrays:
* PspCreateProcessNotifyRoutine (notifies EDR of new processes)
* PspCreateThreadNotifyRoutine (notifies EDR of thread injection)
* ObRegisterCallbacks (prevents process memory access/LSASS dumping)
3. It selectively overwrites the registration pointers with NULL (0x0000000000000000).
4. As a result, the EDR agent remains running in user mode with its services intact, but the Windows kernel stops sending event telemetry. The endpoint is rendered an invisible black box.
3. Comprehensive Credential and Cryptographic Asset Theft
With kernel monitoring blinded, LunexStealer executes its harvesting modules without friction:
* 7 Chromium-Based Browsers: Targets Chrome, Edge, Brave, Yandex, Opera, Opera GX, and Vivaldi. It extracts decrypted master keys from Local State using DPAPI and dumps SQLite vaults containing autofill passwords, session cookies, and credit card autofills.
* 5 Desktop Crypto Wallets: Enumerates and exfiltrates local wallet datastores for Bitcoin Core, Litecoin Core, Exodus (exodus.wallet), Atomic Wallet, and Electrum.
* 4 Browser Extension Wallets: Directly targets storage directories for MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet.
All harvested material is bundled, compressed, and transmitted via HTTP POST to the central C2 panel at 193.178.159[.]128.
4. Advanced Persistence: PowerShell-Backed Native Messaging Host
To maintain long-term command and control after the primary stealer binary is purged, Lunex establishes persistence via Google Chrome’s Native Messaging protocol:
* The Protocol: Native Messaging allows web extensions to communicate with an installed native desktop application over standard input (stdin) and standard output (stdout).
* The Implementation: Lunex registers an NMH manifest under HKCU\Software\Google\Chrome\NativeMessagingHosts\. The registered host is a 13.2 KB PowerShell script extracted from the malware's .rdata section.
* Resilience: Because the PowerShell script executes within Chrome’s process boundary, it does not show up as an unauthorized standalone daemon. It survives file deletion of the original loader, system reboots, and browser restarts.
The embedded PowerShell script implements a full remote access backdoor with six discrete capabilities:# Reconstructed functional commands of Lunex NMH Host
list_drives # Enumerate logical drives C: through Z:
list_dir # Traverse directory trees and report file metadata
read_file # Stream arbitrary files in 512 KB chunks (up to 524 MB)
write # Write arbitrary binary/script payloads to disk
download # Exfiltrate local files to attacker C2
run # Execute arbitrary Windows executables and scripts
Furthermore, Lunex tampers with Chrome’s Secure Preferences file to inject a rogue browser extension configured with blanket permissions (
Threat Actor Operations & Malware-as-a-Service Footprint
Infrastructure telemetry analyzed by Ontinue and BlueTeamCoolTeam reveals rapid commercialization of the Lunex platform:
* Expanding MaaS Fleet: Active Lunex C2 panels grew from 6 instances in June 2026 to 28 distinct administrative panels across 13 countries (including the U.S., Germany, France, the U.K., the Netherlands, Russia, Turkey, and Ukraine) by late September 2026.
* Phishing Infrastructure Integration: Several Lunex panels host dual-purpose modules resolving to brand-impersonation phishing domains (e.g., spoofing Sam’s Club, WhatsApp Business, and corporate password recovery portals), proving that Lunex is operating as a full-spectrum cybercrime franchise.
* Linguistic Markers: Russian-language commentary across backend panels and developer documentation indicates an Eastern European cybercrime nexus.
Defensive Recommendations & Threat Hunting Playbook
Enterprise security operations centers (SOCs) and system administrators must deploy multi-layered mitigations against BYOVD and browser-based persistence:
1. Harden Driver Blocklists and Enforce WDAC
* Deploy Microsoft Recommended Driver Block Rules: Because the default blocklist lags behind emerging threats, enforce custom Windows Defender Application Control (WDAC) policies blocking known vulnerable driver hashes cataloged in the LOLDrivers database.
* Block PDFWKRNL.sys Explicitly: Configure endpoint block rules for the vulnerable AMD driver:
* SHA256 / Authenticode Signer: Advanced Micro Devices, Inc.
* Enforce Strict Memory Integrity: Enable Hypervisor-Enforced Code Integrity (HVCI) alongside Kernel DMA Protection in UEFI BIOS settings.
2. Detect & Audit Chrome Native Messaging Hosts
* Monitor Registry Keys: Alert on newly created entries under:
* HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\
* HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts\
* HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\
* Audit NMH Host Executables: Flag any Native Messaging Host configuration where path points to powershell.exe, cmd.exe, wscript.exe, or non-standard binaries executing from %APPDATA% or %TEMP%.
3. Endpoint Threat Hunting Queries (Sigma / Sysmon)
* Detect CMSTPLUA UAC Bypass: Alert on cmstp.exe or COM processes with GUID {3E5FC7F9-9751-43E1-897C-5DE9E5FE7603} spawning elevated child processes.
* Monitor Driver Loading Events: Alert on Sysmon Event ID 6 (Driver Load) where an unsigned or vulnerable driver is registered by processes outside of Windows Update or authorized IT deployment tools.
4. User Education Against ClickFix Lures
* Train staff to recognize ClickFix lures: legitimate websites, CAPTCHAs, and Cloudflare challenges will never instruct users to press Win + R and execute clipboard strings to verify identity.
Conclusion
Lunex Stealer marks a pivotal evolution in commodity cybercrime. By weaponizing a signed AMD kernel driver to silently blind EDR telemetry and anchoring long-term persistence inside browser native messaging architectures, the malware achieves a level of stealth historically reserved for advanced persistent threats (APTs). Organizations must treat kernel-mode driver loading policies and browser extension ecosystems as critical enterprise frontiers.
Stay ahead of emerging malware architectures and threat actor playbooks at Digital Spying.