Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Researchers have discovered that the Lunex malware is part of a larger malware-as-a-service platform. This malware, also known as Psychedelic Stealer, is being distributed through compromised Ukrainian websites that use Cloudflare verification checks. The attack involves a four-stage process targeting Ukrainian-speaking users, starting with a fake CAPTCHA page. The Lunex Stealer is capable of abusing an AMD driver to disable security monitoring and steal browser credentials. The malware's distribution and operation were analyzed by Ontinue, shedding light on its tactics. The attack chain is designed to target specific users, indicating a focused effort by the malicious actors.