Lunex Stealer Exploits AMD Driver to Disable Security Monitoring

Michael Miller · 2026-09-26

A sneaky malware called Lunex is making waves, and it's got a clever trick up its sleeve: it abuses an AMD driver to turn off your security monitoring and swipe your browser credentials. This isn't just another piece of malware; it's part of a malware-as-a-service (MaaS) platform that's being used in targeted attacks. Security researchers at Ontinue recently uncovered the details, and they paint a worrying picture for anyone who thinks they're safe behind antivirus software. ### How Lunex Sneaks In The attack chain kicks off with a fake CAPTCHA page that looks like a Cloudflare verification check. You know the drill: you click a box, and it seems like you're just proving you're human. But instead, it's deploying the Psychedelic Stealer, a nasty piece of code designed to grab your browser passwords, cookies, and other sensitive data. This method, often called ClickFix, has been seen in the wild targeting Ukrainian-speaking users through compromised websites. But don't think you're off the hook just because you're not in Ukraine—cybercriminals are always expanding their reach. ### The Four-Stage Attack Chain Ontinue's analysis breaks down the attack into four distinct stages: - **Initial Compromise:** Victims land on a compromised website and are presented with a fake CAPTCHA. Clicking it triggers a download. - **Execution:** The downloaded file runs a script that exploits a vulnerability in an AMD driver to disable security tools. - **Credential Theft:** With defenses down, the Psychedelic Stealer harvests browser data, including saved passwords and session cookies. - **Exfiltration:** The stolen data is sent back to the attackers' command-and-control server. What makes this particularly dangerous is the abuse of a legitimate AMD driver. By exploiting the driver, the malware can bypass security software that might otherwise catch it. This technique, known as "bring your own vulnerable driver" (BYOVD), is becoming more common among sophisticated threat actors. ### Why You Should Care If you're thinking, "I don't visit sketchy websites, so I'm fine," think again. Compromised websites can be anywhere—even sites you trust. And once the malware is in, it can silently steal your login credentials for email, social media, banking, and more. That's a recipe for identity theft and financial loss. > "The use of a signed AMD driver to disable security monitoring is a classic example of attackers leveraging trusted components to evade detection," says a security researcher at Ontinue. "It's a reminder that even well-protected systems can be vulnerable if users are tricked into running malicious code." ### Protecting Yourself So, what can you do to stay safe? Here are a few practical steps: - **Keep your software updated:** This includes your operating system, browser, and any plugins. Updates often patch vulnerabilities that malware exploits. - **Be skeptical of CAPTCHAs:** If a CAPTCHA seems out of place or asks you to download something, close the page immediately. - **Use a reputable security solution:** While Lunex can disable some tools, a robust endpoint protection platform might still catch it. - **Enable two-factor authentication (2FA):** Even if your credentials are stolen, 2FA can prevent attackers from accessing your accounts. - **Consider an antidetect browser:** Tools like antidetect browsers can help mask your digital fingerprint and make it harder for malware to track you, but they're not a silver bullet. Always combine them with other security measures. ### The Bigger Picture Lunex is just one example of how malware is evolving. The shift to malware-as-a-service means that even low-level criminals can launch sophisticated attacks. And the abuse of legitimate drivers shows that attackers are always finding new ways to slip past defenses. For businesses, this underscores the need for layered security. Don't rely on a single tool to keep you safe. Regularly train employees to recognize phishing and social engineering tactics. And keep an eye on the latest threat intelligence—what's targeting Ukraine today could be targeting you tomorrow. In the end, staying informed and vigilant is your best defense. The bad guys are getting smarter, but so can we.