[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLcM8DHggrWUgdWkHKQ84gSPBJ2a2RFRoVu9JQLSum2w":3},{"article":4,"iocs":49,"watch_terms":71,"solutions":72,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"a75c3e37-aab9-45af-9097-798d45cf6df1","Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials","lunex-stealer-abuses-amd-driver-to-disable-security-monitoring-and-steal-browser-9f0989","The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. \"The attack chain begins with a fake CAPTCHA page and","The Lunex Stealer, also known as Psychedelic Stealer, is a malware-as-a-service platform targeting Ukrainian-speaking users. It employs a four-stage attack chain, beginning with a fake CAPTCHA page and culminating in the deployment of a C2 agent. The stealer extracts credentials from Chromium-based browsers, exfiltrates cryptocurrency wallet data, and establishes persistence by abusing a vulnerable AMD driver (CVE-2023-20598) to escalate privileges and disable security monitoring.","Lunex Stealer abuses AMD driver to disable security monitoring and steal browser credentials.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Flunex-stealer-abuses-amd-driver-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjlKEfNLMvV7mEVtxmw1nS48l0bWRxvhvRH5MHdn20FjDTm6B0_5okfLjQ49AamYo9DPVC1aV1O2bl11Vd8776ziWsV96tcxQviDK0RjOnGK_Dyx_Zs2e2VBjgChf91_H2cHH0u_UoyAGlGlJkKnozWFqf-sxmXNW0QlnfY3Ilgdkg3p4qG7p3Z0SmdnJMq\u002Fs1600\u002Fstealer-malware.jpg","2026-09-26T18:22:52+00:00","2026-09-26T20:00:14.990786+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"AMD Radeon Software","product",{"name":21,"type":19},"LunexLoader",{"name":23,"type":19},"Google Chrome",{"name":25,"type":19},"Microsoft Edge",{"name":27,"type":19},"MetaMask",{"name":29,"type":30},"malware-as-a-service","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,58,62,65,68],{"type":51,"value":52,"context":53},"ip","193.178.159.128","LunexStealer C2 Panel IP address",{"type":55,"value":56,"context":57},"cve","CVE-2023-20598","Vulnerability in AMD Radeon Software driver exploited by Lunex Stealer",{"type":59,"value":60,"context":61},"mitre_attack","T1068","Exploitation for Privilege Escalation (via vulnerable driver)",{"type":59,"value":63,"context":64},"T1547.001","Registry Run Keys \u002F Startup Folder (Persistence)",{"type":59,"value":66,"context":67},"T1059.001","PowerShell (Native Messaging Host)",{"type":59,"value":69,"context":70},"T1071.001","Web Protocols (HTTP for C2 communication)",[18,21,23],{"controls":73,"vendors":157},[74,102,128],{"slug":75,"name":76,"problem":77,"products":78},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[79,87,94],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":75,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":103,"name":104,"problem":105,"products":106},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[107,115,120],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":116,"product_name":117,"url":118,"description":119},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":129,"name":130,"problem":131,"products":132},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[158],{"slug":159,"name":160,"logo_path":161,"roles":162},"arctic-wolf","Arctic Wolf","\u002Fvendor-logos\u002Farctic-wolf.png",[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":181},"lunex-stealer-exploits-vulnerable-amd-driver-to-blind-security-tools-and-harvest-credentials","Lunex Stealer Exploits Vulnerable AMD Driver to Blind Security Tools and Harvest Credentials","The Lunex Stealer exploits CVE-2023-20598, a known vulnerability in an AMD driver, to escalate privileges and disable endpoint security monitoring — a technique known as Bring Your Own Vulnerable Driver (BYOVD). This allows attackers to operate undetected while harvesting browser credentials and cryptocurrency wallet data across multiple stages. The attack begins with a social engineering lure (fake CAPTCHA) and progresses to full C2 agent deployment, demonstrating how unpatched drivers in the kernel layer create catastrophic blind spots for defenders. The fact that this vulnerability was disclosed in 2023 and is still being weaponized highlights the critical gap between patch availability and operational patch deployment.",[169,170,171,172,173,174,175,176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CM-7: Least Functionality (restrict unauthorized driver installation)","NIST AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1555.003: Credentials from Web Browsers","GDPR Article 32: Security of Processing (credential theft impacts personal data)",{}]