[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8px1xBlhjrDeKKLREV1cf6DhwNqllIp762o0kEapF0c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"45974a45-c900-446b-8945-8b4c98ce38ea","lunex-stealer-exploits-vulnerable-amd-driver-to-blind-security-tools-and-harvest-credentials","a75c3e37-aab9-45af-9097-798d45cf6df1","Lunex Stealer Exploits Vulnerable AMD Driver to Blind Security Tools and Harvest Credentials","The Lunex Stealer exploits CVE-2023-20598, a known vulnerability in an AMD driver, to escalate privileges and disable endpoint security monitoring — a technique known as Bring Your Own Vulnerable Driver (BYOVD). This allows attackers to operate undetected while harvesting browser credentials and cryptocurrency wallet data across multiple stages. The attack begins with a social engineering lure (fake CAPTCHA) and progresses to full C2 agent deployment, demonstrating how unpatched drivers in the kernel layer create catastrophic blind spots for defenders. The fact that this vulnerability was disclosed in 2023 and is still being weaponized highlights the critical gap between patch availability and operational patch deployment.","**Immediate actions:**\n- Apply the vendor patch for CVE-2023-20598 immediately or blocklist the vulnerable AMD driver using Windows Defender Application Control (WDAC) or similar controls.\n- Enable Microsoft's Vulnerable Driver Blocklist (HVCI) to prevent known malicious drivers from loading at the kernel level.\n\n**Long-term improvements:**\n- Maintain a complete inventory of all installed drivers and firmware across endpoints and enforce a driver patch cadence aligned with your vulnerability management SLA.\n- Implement a Bring Your Own Vulnerable Driver (BYOVD) detection strategy by integrating kernel-level telemetry into your SIEM for anomalous driver load events.\n- Adopt application allowlisting policies that restrict unauthorized driver installation to reduce the kernel attack surface.\n\n**Detection measures:**\n- Configure EDR\u002FXDR solutions to alert on privilege escalation attempts and unexpected termination or tampering of security agent processes.\n- Monitor for suspicious CAPTCHA-themed phishing delivery vectors and establish DNS\u002Fweb filtering rules to block known C2 infrastructure associated with Lunex\u002FPsychedelic Stealer.\n- Implement browser credential theft detection by auditing access to browser credential stores (e.g., Login Data SQLite files) from non-browser processes.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CM-7: Least Functionality (restrict unauthorized driver installation)","NIST AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1555.003: Credentials from Web Browsers","GDPR Article 32: Security of Processing (credential theft impacts personal data)",{},"published","2026-09-26T20:20:53.87475+00:00","2026-09-26T20:20:53.807+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Flunex-stealer-abuses-amd-driver-to.html","lunex-stealer-abuses-amd-driver-to-disable-security-monitoring-and-steal-browser-9f0989","Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"13c8d089-3c57-4fc1-a760-c0f278e03864","2026-09-27","morning","ThreatNoir Weekend Brief — September 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-27\u002Fthreatnoir-morning-brief-2026-09-27.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":64,"name":65,"problem":66},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":68,"name":69,"problem":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]