Image: thaicert.or.th · rights & removal

Lunex Malware Exploits Vulnerable AMD Driver to Bypass Security Tools and Steal User Data

Reporting by Thailand ThaiCERT AdvisoriesRead the original at thaicert.or.th

Executive Summary

Cybersecurity researchers disclosed a campaign utilizing Malware-as-a-Service named Lunex, also known as Psychedelic Stealer, which is expanding attacks globally. Threat actors are employing deceptive tactics by using fake websites that mimic Cloudflare verification pages to prompt users to download malware. The attack chain involves tricking victims into clicking a prompt, launching an installer, and executing a tool designed to bypass User Account Control (UAC). The malware then uses a Bring Your Own Vulnerable Driver (BYOVD) technique targeting CVE-2023-20598 in an AMD Radeon driver to gain privileges and interfere with security software. This disruption allows the malware to covertly steal sensitive data, including passwords, browser cookies, and cryptocurrency wallet information from web browsers. Furthermore, the malware can manipulate the file system and install malicious browser extensions, ensuring persistent access even after system restarts.

Facts Only

* Cybersecurity researchers from Ontinue disclosed a campaign involving Malware-as-a-Service named Lunex (Psychedelic Stealer).
* Threat actors use fake websites imitating Cloudflare verification pages to trick users into downloading malware.
* The malware uses a tool to bypass User Account Control (UAC) after a fake prompt is clicked.
* Malware employs a Bring Your Own Vulnerable Driver (BYOVD) technique targeting CVE-2023-20598 in an AMD Radeon driver.
* This technique targets privilege elevation and interference with security software.
* The malware steals passwords, browser cookies, and cryptocurrency wallet data from web browsers.
* It deploys scripts to manipulate the file system and install malicious browser extensions.
* The attack infrastructure is expanding, supporting the creation of additional phishing websites.
* Administrators should monitor related driver files, specifically PDFWKRNL.sys.
* General users should exercise caution with CAPTCHA-style prompts or downloads from suspicious websites.

Full Take

The narrative describes a progression where initial deception transitions into deep system compromise through the exploitation of specific, known vulnerabilities (CVE-2023-20598) via driver manipulation. The pattern involves leveraging widely used infrastructure mimicry (Cloudflare) combined with low-level operating system exploits (UAC bypass, BYOVD) to achieve persistence and stealth. This indicates a shift from superficial phishing to deep technical compromise facilitated by a supply chain vulnerability in drivers. The focus on monitoring specific files like PDFWKRNL.sys suggests an established playbook for advanced persistence that requires specialized knowledge beyond standard endpoint protection. The implication is that security defenses, even those implemented by major vendors like Microsoft, require continuous vigilance against low-level system manipulation and the weaponization of existing driver weaknesses. The cost is borne by users whose data and financial assets are targeted, while administrators face the challenge of monitoring dynamic, low-level artifacts for compromise. What assumptions about the resilience of software-based security controls, particularly when operating at the kernel or driver level, must be challenged? How can vigilance effectively address threats that exploit the subtle interplay between legitimate system functions and malicious injection techniques?

From the original · Thailand ThaiCERT Advisories

532/69 Monday, September 28, 2026 Cybersecurity researchers from Ontinue have disclosed a campaign involving Malware-as-a-Service known as Lunex, also referred to as Psychedelic Stealer, which is expanding its attacks against users across multiple countries.

Read the full story at thaicert.or.th

Sentinel — Human

Confidence

The text reads like a standard security advisory reporting on a specific threat actor campaign, blending technical specifics with actionable user advice.

Signals Detected

Moderate sentence length variance; professional but direct tone.

Logical flow from disclosure to mechanism to implications; clear target audience segmentation (admin vs. user).

Specific technical details (CVE, file names) are cited without apparent restatement from multiple sources.

The structure and specific call-to-action feel aligned with legitimate threat reporting.

Human Indicators

Use of highly specific, technical jargon (BYOVD, CVE-2023-20598, PDFWKRNL.sys) woven into a narrative flow suggests domain expertise.

The structure transitions smoothly from high-level disclosure to low-level technical mechanics and then practical advice.