Cybersecurity researchers have revealed details of a sophisticated attack involving the new malware-as-a-service platform Lunex Stealer (also known as Psychedelic Stealer), which targets Ukrainian-speaking users through compromised websites hosting fake CAPTCHA pages. The attack exploits a vulnerable AMD Radeon driver (CVE-2023-20598) through the Bring-Your-Own-Vulnerable-Driver (BYOVD) technique to disable security monitoring while preserving process visibility, steals credentials from seven Chromium-based browsers and cryptocurrency wallets, and establishes persistent remote filesystem access through Chrome Native Messaging Hosts.
Key facts: Lunex exploits CVE-2023-20598 in the AMD PDFWKRNL.sys driver; the BYOVD technique zeroes kernel callbacks to blind EDR; steals credentials from 7 Chromium browsers (Chrome, Edge, Brave, Yandex, Opera, Opera GX, Vivaldi); extracts data from 9 cryptocurrency wallets; 28 C2 panels identified across 13 countries; the platform was created by Russian-speaking developers.
The Lunex Stealer attack follows a carefully designed four-stage chain that begins with social engineering and ends with full control over the victim's system.
The attackers compromise legitimate Ukrainian websites by injecting iframe elements that serve ClickFix-like fake CAPTCHA pages. These pages instruct the victim to execute an msiexec command that silently installs a malicious MSI package from the attacker's server. The MSI package elita.msi (1.1 MB) is an unsigned OLE Compound Document presenting itself as "Vertification" from "Internal Software" — the intentional misspelling corresponds to the Ukrainian word used in the lure text.
The installer uses several techniques to minimize detection: the LIMITUI=1 property suppresses the standard Windows Installer wizard, while installation takes place in the user directory %LOCALAPPDATA%\Programs\Internal Software\Vertification\ without requesting administrator privileges or triggering a UAC elevation prompt. The ARPNOMODIFY=1 and ARPNOREPAIR=1 properties hide the Modify and Repair buttons from the Add/Remove Programs panel. A type 226 Custom Action at position 6700 automatically launches the payload immediately after InstallFinalize, while the "continue on error" flag means the MSI reports a successful installation even if the payload fails to execute.
The second stage is a 2.3 MB 64-bit executable named psychedelic.exe (also config.exe), compiled with MinGW-w64 and masquerading as a nonexistent "Update Manager" from Canonical Ltd. Its compilation timestamp is falsified to the year 2054, while two TLS callbacks execute before the PE entry point — a strong indicator of malware. All operational strings in the binary are encrypted using AES-256 in CTR mode with a 32-byte key and 16-byte IV embedded in the .rdata section.
The loader implements a sophisticated Import Address Table obfuscation scheme through a dead-code function protected by the condition GetTickCount() == 0x9E3779B9 (a TEA/XTEA cipher constant derived from the golden ratio). This is mathematically impossible during normal execution. The function calls 55 imported APIs with NULL parameters, existing solely to inflate the Import Address Table with decoy entries from SHELL32, WINHTTP, WS2_32, CRYPT32, GDI32 and ten additional DLLs.
For privilege escalation, the loader executes a four-step chain: it overwrites ImagePathName, CommandLine and InMemoryOrderModuleList in the Process Environment Block using a path derived from GetWindowsDirectoryA; invokes CoGetObject with a COM Elevation Moniker string for the CMSTPLUA COM object, which is marked as auto-elevate in the Windows registry; enables SeLoadDriverPrivilege through OpenProcessToken and AdjustTokenPrivileges; and installs and loads the BYOVD driver through OpenSCManagerA, CreateServiceA and StartServiceA.
The loader reads C:\Windows\system32\ntoskrnl.exe to extract the RSDS PDB GUID from the PE debug directory, then launches curl.exe with the User-Agent Microsoft-Symbol-Server/10.1700.661.0 to download ntkrnlmp.pdb from the official Microsoft Symbol Server. The downloaded PDB file contains exact structure offsets and type definitions for the specific Windows kernel build. The loader memory-maps the PDB and parses it through eight dbghelp.dll APIs, resolving 15 kernel symbols including PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, PspLoadImageNotifyRoutine, ActiveProcessLinks, Token, Protection, SignatureLevel and CallbackListHead.
The loader then decrypts a 2 MB AES-256-GCM encrypted overlay (91% of the file size), which turns out to be a native x64 kernel driver. Before deploying the driver, the loader checks running processes and kernel modules against a 20-item blocklist that includes drivers from Microsoft Defender, Kaspersky (6 drivers), Dr.Web (3 drivers), ESET (3 drivers), Elastic, Sysinternals, CrowdStrike and SentinelOne. Entry 20 is fltMgr.sys, the Windows Filter Manager itself; removing hooks from this driver disables all minifilter-based security products simultaneously.
The loader installs the vulnerable AMD driver PDFWKRNL.sys (USB-C Power Delivery Firmware Update Utility Driver), which is signed through the AMD → Sectigo → USERTrust → Microsoft Code Verification Root chain. The driver registers a device at .\PdFwKrnl and handles IRP_MJ_DEVICE_CONTROL through a switch statement covering 12 IOCTL control codes without any access checks. IOCTL 0x80002028 copies the contents of the kernel callback table into a user-mode buffer, while IOCTL 0x80002014 writes zeros into callback table entries belonging to security products. The loader uses the read IOCTL to retrieve the callback table contents, determines which kernel module owns each entry through K32GetDeviceDriverBaseNameA, checks the module name against the 20-item blocklist and zeroes matching entries through the write IOCTL.
After zeroing the kernel callbacks, the loader downloads the final payload psychedeliclove.exe (a 275 KB 64-bit executable compiled on September 12, 2026) from http://107.175[.]82[.]242:9000/wilow/psychedeliclove.exe. The binary contains 11 PE sections, 169 imports across 11 DLLs and an embedded 2,124-byte JSON configuration in a custom .embed section.
LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP using API-key authentication. The protocol follows a structured flow: initialization, configuration decryption, machine fingerprinting with 17 collected fields, check-in with a kill switch check, credential and wallet theft with structured exfiltration, and persistent task polling with randomized heartbeat intervals (20-25 seconds of jitter).
For browser credential theft, LunexStealer targets seven Chromium-based browsers: Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX and Vivaldi. Browser processes are terminated through taskkill /F /IM to release locks on SQLite database files. The binary does not link against the SQLite library, instead implementing a custom B-tree page parser to read browser databases directly. Encryption key extraction handles three Chrome versions: Version 10 uses AES-GCM with a DPAPI-protected master key; Version 11 (Chrome's App-Bound Encryption, introduced in July 2024) requires COM-based process injection with generated x64 shellcode to interact with Chrome's IElevator COM service; Version 20 uses ChaCha20-Poly1305 authenticated encryption.
Critical persistence: LunexStealer establishes three independent persistence channels: a Registry Run key, a hidden scheduled task named "psychedelicloveUtils" and a Chrome Native Messaging Host through HKCU\Software\Google\Chrome\NativeMessagingHosts\com.lunex.explorer. The NMH is backed by a 13,200-byte PowerShell script providing six filesystem actions: list_drives, list_dir, read_file (up to 524 MB), write, download and run. This persistence survives removal of the stealer binary, system reboots and browser restarts.
The campaign operated through three hosts under different providers in different countries. The payload server at 107.175.82[.]242 (OneProvider, Seattle) served LunexStealer on port 9000 and was managed through EasyPanel. The exfiltration server at 193.178.159[.]128 (UFO Technologies, Roubaix, France) hosted four services: the Lunex operator panel on port 8000, a REST API on port 8080, a publicly exposed phpMyAdmin 5.2.3 instance on port 8081 with a root MySQL user, and SSH. The delivery domain uasputnik[.]com resolved to shared hosting in Warsaw, Poland.
Both C2 hosts had an identical SSH HASSH fingerprint, confirming that a single operator managed both servers using the same provisioning tooling. TLS was not configured on any C2 port. The phpMyAdmin instance provided direct, unauthenticated database access. The operator's infrastructure security was poor, contrasting sharply with the technical sophistication of the loader — suggesting either separate individuals handling development and operations or infrastructure designed to be disposable.
Analysis of the Lunex panel frontend (a React single-page application served by nginx) revealed a 453 KB JavaScript bundle containing the complete operator interface. The internationalization framework (i18next) loads Russian as the default locale. More than 150 Russian-language UI strings are embedded, including empty-state messages ("Ботов пока нет – подключи установщик с API-ключом"), error messages ("Неверный логин или пароль") and operational labels ("Команд в очереди"). The language selector lists "Русский" as the primary option. A placeholder example in the browser spoofing configuration uses "ya.ru" (the Yandex Russia homepage) as the target domain.
UFO Technologies in Krasnogorsk (Moscow Region) hosts four panels, making it the most concentrated cluster. One of these panels (193.178.158.61) is located in the same /24 network as the exfiltration server analyzed here, suggesting shared operator infrastructure. One panel in Turkey (103.101.85[.]123) resolved to five phishing domains: account-sams-club[.]com, teamwork-recover-password[.]com, namshi-uae[.]com, whatsappbusineses[.]com and ibraq-perfumes[.]com, confirming the use of Lunex for brand impersonation and phishing alongside credential theft.
Lunex Stealer implements several techniques that exceed the typical sophistication of an information stealer. FNV-1a hash-based API resolution, similar to Cobalt Strike's Beacon, avoids plaintext API name strings in memory. The binary extracts raw syscall numbers directly from ntdll.dll to execute direct syscalls, bypassing user-mode EDR hooks. Custom implementations throughout, including a hand-written JSON parser with linked-list dictionaries, an SQLite B-tree page reader, a ZIP builder with raw PK headers and Shell.Application COM-based extraction, eliminate external library dependencies that signature-based detection could target.
Full Ghidra decompilation across 275 functions produced 992 KB of pseudocode. The Chrome Secure Preferences integrity bypass present in LunexStealer initially suggested a potential link to APT31's SUPERSTOMP tool, documented by Volexity on September 9, 2026. However, during September 2026, at least four independent implementations of the same bypass were identified in unrelated operations, indicating that the technique has fully proliferated and is no longer a reliable indicator of state-sponsored activity.
| Technique | Description | Purpose |
|---|---|---|
| PEB masquerade | Overwriting ImagePathName and CommandLine in the Process Environment Block | Masquerading as legitimate Windows binaries for auto-elevate COM |
| PDB-guided symbol resolution | Downloading kernel debugging symbols from Microsoft Symbol Server | Version-agnostic retrieval of kernel structure offsets |
| Dead-code IAT anchor | Unreachable function with 55 decoy API imports | Inflating the Import Address Table with false entries |
| AES-256 string encryption | All operational strings encrypted in CTR mode | Hiding API names, file paths, registry keys and C2 URLs |
| Direct syscalls | Raw syscall numbers from ntdll.dll | Bypassing user-mode EDR hooks |
| Custom B-tree parser | Self-implemented SQLite database reader | Eliminating external library dependencies |
For defenders, the critical insight is that detection should focus on the stages before EDR blindness occurs: PDB downloads from non-development processes, driver drops into temporary directories and service creation for unsigned drivers from non-standard paths. After EDR blindness occurs, the Native Messaging Host registry key (NativeMessagingHosts\com.lunex.explorer) is the most reliable indicator of compromise and should be included in any remediation scope alongside the stealer binary, scheduled task and Run key.
| Type | Indicator | SHA-256 / Value |
|---|---|---|
| MSI installer | elita.msi | 38E90AFFE37342EE36917CDC535FE9BF04589AFA8430EB8D1BA1016ADCFC1878 |
| Loader | psychedelic.exe / config.exe | bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8 |
| BYOVD driver | PDFWKRNL.sys (CVE-2023-20598) | 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1 |
| Stealer | psychedeliclove.exe | 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90 |
| C2 server | Exfiltration endpoint | 193.178.159[.]128:8080 |
| Delivery domain | Fake CAPTCHA host | uasputnik[.]com |
| API key | X-API-Key header | c9daf8dbafc5e1f63e4af742a14a8a6669365e106ab0247ab366621bbc1f6967 |
| Registry persistence | Native Messaging Host | HKCU\Software\Google\Chrome\NativeMessagingHosts\com.lunex.explorer |
Lunex Stealer represents a significant evolution in information stealer tactics, combining legitimate driver abuse with browser-based persistence mechanisms to evade detection while maintaining long-term access to victim systems. The platform has expanded rapidly since June 2026, with 28 unique command-and-control panels identified across 13 countries, demonstrating active development and distribution among multiple criminal groups. For organizations, this highlights the need for multi-layered protection that includes controlling driver installation, monitoring kernel-level activity and regularly auditing browser extensions and Native Messaging Host configurations.
“In the world of cybersecurity, the most dangerous attack is the one you cannot see. When malware blinds your security tools but leaves them running, you think everything is fine while your data has already been stolen.”
— Mikko Hypponen, Chief Research Officer at F-Secure
