Lunex Stealer Abuses AMD Driver to Disable Security Monitoring

Researchers at Ontinue detailed the Lunex malware-as-a-service platform, which spreads Psychedelic Stealer via compromised Ukrainian websites using fake Cloudflare ClickFix checks. The four-stage attack chain abuses an AMD driver to disable security monitoring and steal browser credentials.

• Attack spreads via compromised Ukrainian sites and fake ClickFix CAPTCHA
• Four-stage chain targets Ukrainian-speaking users
• AMD driver is abused to disable security tooling
• Lunex is part of a broader malware-as-a-service platform