Lunex Malware-as-a-Service Platform Unmasked as the Force Behind Sophisticated Psychedelic Stealer Attacks

Cybersecurity researchers have uncovered the underlying infrastructure of a rapidly growing cybercriminal enterprise, linking the recently identified Psychedelic Stealer malware to a sophisticated Malware-as-a-Service (MaaS) platform known as Lunex. This ecosystem utilizes highly calculated attack chains, including compromised legitimate websites, fake Cloudflare security verification prompts, and advanced defense evasion tactics, to target users primarily within the Ukrainian-speaking digital landscape.

The scope of this campaign highlights an alarming evolution in modern cybercrime. What initially appeared to be isolated incidents involving malicious software distributed through compromised local business websites is, in fact, part of a distributed, highly organized criminal platform. By offering turnkey operations to various threat actor groups, the creators of Lunex have demonstrated a capacity for rapid global expansion, innovative persistence mechanisms, and advanced techniques designed to blind enterprise security systems while silently draining victims of sensitive credentials and cryptocurrency assets.

Anatomy of the Attack Chain: From Fake CAPTCHA to Deep System Penetration

Recent technical analysis conducted by cybersecurity firm Ontinue sheds light on the mechanics of the Lunex operation, categorizing the multi-stage infection sequence as a highly efficient, four-stage attack chain. The assault typically begins when unsuspecting users navigate to legitimate, compromised web portals. Security researchers from Arctic Wolf Labs previously detailed how threat actors managed to compromise local Ukrainian websites—ranging from a hair-treatment clinic and a scale-model manufacturer to a specialist bookseller, a psychological facility, and automotive and tool retailers.

Upon visiting these trusted domains, users are greeted by a malicious iframe element designed to serve a deceptive user-verification scheme. Modeled after legitimate Cloudflare security checks, the prompt utilizes a "ClickFix" social engineering tactic, coercing visitors into executing commands or downloading what is claimed to be a necessary update or verification tool. In reality, these payloads deliver bogus Microsoft Software Installer (MSI) files that initiate the infection process.

Once the initial loader—dubbed LunexLoader—gains a foothold on the target machine, it launches a series of automated scripts designed to bypass Windows User Account Control (UAC). This is achieved by hijacking the CMSTPLUA COM object, a technique that allows the software to execute privileged operations without triggering standard administrative alerts. Following this escalation phase, the malware deploys a technique rarely seen prior to final-stage information stealer deployment: a Bring Your Own Vulnerable Driver (BYOVD) attack.

Exploiting Kernel-Mode Vulnerabilities for Defense Evasion

The integration of the BYOVD technique represents a significant escalation in the sophistication of information-stealing campaigns. Rather than simply attempting to terminate security software—an action that typically triggers immediate behavioral alerts from Endpoint Detection and Response (EDR) solutions—Lunex utilizes a legitimate, signed kernel-mode driver to quietly disarm protective monitoring tools while keeping their processes running in the background.

Specifically, the malware leverages a vulnerable driver associated with AMD Radeon Software (identified by the filename "PDFWKRNL.sys"), which is susceptible to a known security flaw tracked as CVE-2023-20598. By loading this vulnerable driver into the Windows kernel, the attackers achieve the privilege levels necessary to blind security products without shutting them down entirely.

According to security analysts, this methodology leaves security tools in a state of suspended animation, rendering them blind to subsequent malicious activities while preventing the operating system from registering a sudden crash or shutdown of defensive services. Furthermore, testing has revealed that neither Hypervisor-Protected Code Integrity (HVCI) nor Microsoft’s standard Vulnerable Driver Blocklist successfully prevents this specific variant of the driver from loading—a persistence vulnerability that has persisted despite the driver hash being catalogued in open-source threat intelligence repositories like the LOLDrivers project.

Data Exfiltration and Deep Browser Persistence

Once security mechanisms have been effectively neutralized, the core payload—commercially or operationally known as LunexStealer or Psychedelic Stealer—is deployed to the compromised endpoint. The primary objective of this component is the systematic harvesting of valuable digital assets.

Research indicates that the stealer extracts sensitive credentials, session cookies, and autofill data from at least seven distinct Chromium-based web browsers. In addition to credentials, the malware scours the local filesystem for cryptocurrency wallet data, attempting to drain decentralized finance assets immediately upon infection.

To maintain long-term access, the Lunex platform implements a robust persistence mechanism leveraging a PowerShell-based Native Messaging Host (NMH). Embedded directly within the .rdata section of a binary, a 13,200-byte PowerShell script implements the Chrome Native Messaging protocol over standard input and output streams. Operating entirely within the context of the browser process, this host survives standard stealer binary deletion, system reboots, and browser restarts.

The embedded NMH script supports a wide variety of filesystem and browser manipulation actions. Most notably, LunexStealer actively manipulates Chrome Secure Preferences to inject a malicious browser extension. By declaring extensive permissions—including access to cookies, browsing history, bookmarks, tabs, storage, proxies, scripting, and declarative network request filtering—the injected extension grants the operators total visibility and continuous control over the victim’s web browsing sessions.

Chronology of Discovery and Global Infrastructure Expansion

The public tracking of the Lunex ecosystem began earlier this year, marking a steady progression in the identification of its command-and-control (C2) infrastructure. In June 2026, threat intelligence researchers, including Luke Wilkinson of BlueTeamCoolTeam, identified six active Lunex Stealer C2 panels operating across multiple jurisdictions, including the United States, Finland, Germany, the Netherlands, and Ukraine.

Subsequent investigations revealed that "Psychedelic" designates the specific file variant executing on a victim’s device, whereas "Lunex" refers to the underlying MaaS platform distributed to various criminal syndicates. Upon successful execution, the stealer establishes continuous communication with the core infrastructure—such as a known panel hosted at 193.178.159[.]128 over standard HTTP—to facilitate real-time data exfiltration.

By late September 2026, coordinated disclosures by firms such as Arctic Wolf Labs and Ontinue mapped a dramatic expansion of the platform. Analysts identified 28 unique C2 panels distributed across 13 countries, reflecting a geographical footprint that now encompasses Russia, the United States, the United Kingdom, the Netherlands, France, Germany, Turkey, and Bangladesh.

This rapid proliferation underscores the commercial nature of the threat. The infrastructure is not managed by a single isolated collective; rather, the MaaS model allows multiple distinct threat actor groups to license the Lunex framework for their respective campaigns. Further compounding these concerns, researchers analyzing panels hosted in Turkey discovered domain resolutions pointing to localized phishing operations, indicating that the platform’s capabilities extend beyond credential theft into brand impersonation and targeted credential harvesting.

Implications for Enterprise Security and Future Outlook

The emergence and maturation of the Lunex platform underscore an ongoing shift in the cybercrime landscape toward modular, highly evasive tooling previously reserved for advanced persistent threat (APT) groups. The commoditization of kernel-level exploits, such as BYOVD drivers used for EDR blinding, lowers the technical barrier for cybercriminals while significantly raising the risk profile for corporate and individual networks alike.

Security experts emphasize traditional perimeter defenses and standard user prompts are increasingly insufficient against sophisticated social engineering campaigns like ClickFix. Because the attack relies on deceiving users into manually executing commands or installing fake updates under the guise of security verifications, user awareness remains a critical vulnerability.

Furthermore, organizations are urged to update their software component inventory, monitor for unauthorized kernel driver loads, and tighten monitoring around browser extension installations and native messaging hosts. As threat actors continue to refine MaaS platforms like Lunex, the cybersecurity community faces an ongoing challenge in closing systemic kernel vulnerabilities and mitigating the threat of silent, EDR-neutralizing information stealers.