Lunex Malware as a Service Platform Expands Reach Through Sophisticated BYOVD Attacks on Ukrainian Targets

The landscape of cyber-criminality has shifted toward increasingly modular and stealthy operations, as evidenced by the rapid proliferation of the Lunex Malware-as-a-Service (MaaS) platform. Recent investigations by threat intelligence firm Ontinue have unmasked a sophisticated four-stage attack chain that leverages the Psychedelic Stealer—a potent information-gathering agent—to target Ukrainian-speaking users. By compromising legitimate websites and employing advanced evasion techniques like Bring Your Own Vulnerable Driver (BYOVD), the operators behind Lunex have demonstrated a significant evolution in both capability and scale.

The Anatomy of the Lunex Attack Chain

The infection vector utilized by the Lunex operators relies on a social engineering technique known as "ClickFix." Attackers inject malicious iframes into otherwise legitimate websites—ranging from niche retail outlets to professional services—that prompt visitors with fake Cloudflare verification challenges. Once a user interacts with these deceptive prompts, they are coerced into downloading a fraudulent MSI installer.

The execution chain is meticulously designed to bypass modern Windows security measures. Upon execution, the installer deploys the "LunexLoader," a component that performs several critical functions:

1. UAC Bypass: Utilizing the CMSTPLUA COM object, the loader elevates its privileges without triggering standard Windows User Account Control warnings.
2. BYOVD Defense Evasion: The loader introduces a vulnerable kernel-mode driver, specifically a compromised version of "PDFWKRNL.sys" associated with AMD Radeon Software. This driver is exploited to gain kernel-level access, allowing the malware to "blind" security software and Endpoint Detection and Response (EDR) agents without crashing them, thereby avoiding detection.
3. Payload Delivery: Once security protections are neutralized, the system downloads the final Psychedelic Stealer payload.

This specific use of the PDFWKRNL.sys driver is particularly concerning. Despite being identified in the LOLDrivers project as early as March 2026, the specific variant used by the Lunex operators remains effective against current iterations of Microsoft’s Vulnerable Driver Blocklist and Hypervisor-Protected Code Integrity (HVCI).

Chronology and Operational Expansion

The emergence of Lunex represents a calculated effort to institutionalize information theft. Cybersecurity experts first flagged the potential for such a platform in June 2026, when researcher Luke Wilkinson of BlueTeamCoolTeam identified six active command-and-control (C2) panels distributed across various international jurisdictions, including the United States, Germany, and Ukraine.

Since that initial discovery, the threat has metastasized. By September 2026, Arctic Wolf Labs and Ontinue reported a marked increase in the number of compromised websites and active panels. Currently, researchers have catalogued 28 unique C2 panels spanning 13 different countries. This geographic diversification suggests that the platform is not merely the work of a single threat actor but is being leased to multiple criminal syndicates under the MaaS model.

The transition from a nascent set of servers to a global network of panels in under four months indicates a robust infrastructure designed for rapid scaling and long-term persistence. The panels are now hosted in diverse locations, including Russia, Turkey, the United Kingdom, and Bangladesh, further complicating efforts by law enforcement to dismantle the network.

Technical Deep Dive: The Psychedelic Stealer

The term "Psychedelic Stealer" refers to the specific malicious binary that resides on the victim’s device, while "Lunex" serves as the broader ecosystem. Once active, the stealer establishes a persistent foothold through a PowerShell-based Native Messaging Host (NMH). This component is particularly resilient, surviving browser restarts, system reboots, and even the deletion of the original stealer binary.

The stealer’s capabilities are comprehensive:

• Credential Harvesting: It extracts passwords and session cookies from at least seven major Chromium-based browsers.
• Financial Theft: It targets cryptocurrency wallet files, seeking to drain digital assets directly from the victim’s machine.
• Browser Manipulation: By altering Chrome’s Secure Preferences, the malware installs a malicious extension with broad permissions. This grants the attackers the ability to monitor the user’s history, intercept HTTP/HTTPS traffic, and even manipulate proxy settings, effectively turning the victim’s browser into a surveillance tool.
• File System Access: The PowerShell script embedded in the .rdata section allows for six distinct file system actions, granting the operator remote control over the victim’s local files.

The Strategic Threat of BYOVD

The "Bring Your Own Vulnerable Driver" technique marks a departure from traditional malware tactics. Rather than attempting to disable antivirus software—which would trigger an immediate alert—the Lunex operators use the vulnerable driver to perform "PDB-guided kernel callback zeroing."

This allows the malware to remain resident in the system’s memory while rendering security products essentially deaf and blind. By patching the kernel to suppress notifications, the malware ensures that even if a security product is technically "running," it cannot communicate the presence of the infection to the central management console. This "quiet" approach allows the attackers to maintain long-term access, maximizing the volume of data harvested from the victim.

Implications for Enterprise and Individual Security

The rapid growth of the Lunex platform poses significant risks for both individuals and organizations. The ability of this malware to bypass standard security controls through kernel-level manipulation is a stark reminder that legacy security postures are increasingly inadequate.

For organizations, the risk is twofold: not only can employees’ personal credentials be stolen, but these compromised machines can serve as beachheads for lateral movement within corporate networks. The fact that the attackers are using legitimate, signed drivers to bypass security updates underscores a systemic failure in the current driver signing and validation ecosystem.

Furthermore, the expansion of Lunex into brand impersonation and phishing—evidenced by the discovery of panels that resolve to multiple phishing domains—suggests that the platform is becoming a one-stop-shop for cybercrime. Threat actors using this service no longer need deep technical expertise to execute complex, multi-stage attacks; they merely need to purchase access to the Lunex panel.

Future Outlook and Mitigation

The resilience of the Lunex platform is a testament to the effectiveness of the MaaS model. By separating the development of the malware (the developers) from the deployment of the attacks (the affiliates), the operators create a layer of abstraction that makes attribution and mitigation exceptionally difficult.

As the platform continues to expand, security researchers emphasize the need for more granular control over driver loading. Organizations are encouraged to:

1. Implement Strict Kernel Mode Code Signing (KMCS) policies: Restrict the loading of third-party drivers to only those explicitly required for hardware functionality.
2. Monitor for Unusual PowerShell Activity: Since the NMH utilizes PowerShell for persistent access, behavioral monitoring of script execution is critical.
3. Enhance Browser Hardening: Organizations should employ managed browser policies that restrict the installation of unauthorized extensions and limit access to sensitive storage locations.

The emergence of Lunex is a significant development in the 2026 threat landscape. It demonstrates that the barrier to entry for highly sophisticated, state-level-adjacent attack techniques—like BYOVD—is lowering. As this platform continues to evolve, the cybersecurity community must shift toward more proactive, behavior-based detection methods to identify and neutralize these threats before they can gain the foothold necessary to facilitate large-scale information theft.