A sophisticated malware campaign that has targeted Ukrainian users through compromised legitimate websites is part of a broader, rapidly expanding malware-as-a-service enterprise known as Lunex, according to new technical findings.
The campaign, which relies on the deceptive "ClickFix" social engineering tactic disguised as legitimate Cloudflare verification prompts, deploys an information stealer previously identified in the wild as Psychedelic Stealer. However, research published by cybersecurity firm Ontinue reveals that the stealer is merely the final stage of a modular, four-stage attack chain backed by a full-scale commercial crimeware ecosystem designed to harvest sensitive data, subvert enterprise defenses, and maintain deep persistence within targeted systems.
The underlying platform, known to security researchers as Lunex, represents an evolution in commodity malware, blending traditional credential-theft capabilities with kernel-level defense evasion techniques typically reserved for high-tier cyberespionage groups or advanced ransomware syndicates.
According to technical analysis conducted by Ontinue threat researcher Rhys Downing, the multi-stage infection sequence begins with an initial lure presented on compromised Ukrainian websites. Threat actors manipulate users into running malicious commands through fake security checks, ultimately culminating in the execution of an information-stealing payload equipped with comprehensive command-and-control functionality. Downing noted that the stealer systematically extracts credentials and sensitive information from seven Chromium-based web browsers, targets cryptocurrency wallets for exfiltration, and establishes an evasive, persistent remote filesystem backdoor by weaponizing a PowerShell-based Native Messaging Host embedded directly within the victim’s browser environment.
The deployment relies on weaponized Microsoft Installer files distributed through the ClickFix lure. Once executed by an unsuspecting user, the installer triggers an execution sequence driven by an intermediate loader known as LunexLoader. To bypass operating system protections without alerting the user, the loader abuses the elevated CMSTPLUA Component Object Model interface to achieve User Account Control bypass on Windows platforms.
Once administrative privileges are established, the malware executes an evasive Bring Your Own Vulnerable Driver attack before delivering the primary stealer component. The integration of a BYOVD technique within an information stealer distribution chain represents a departure from standard crimeware practices, where kernel-level drivers are seldom utilized simply to deploy credential-harvesting tools.
In this campaign, Lunex operators abuse a legitimate, cryptographically signed kernel-mode driver associated with AMD Radeon Software. The driver file, named PDFWKRNL.sys, is susceptible to a high-severity flaw tracked as CVE-2023-20598. By loading this vulnerable driver onto the host machine, the malware gains the ability to execute code in kernel space, effectively bridging the boundary between userland execution and the core operating system.
Instead of abruptly terminating security tools—an action that typically generates high-priority alerts within Security Operations Centers and triggers automated incident response protocols—Lunex uses the driver to perform program database-guided kernel callback zeroing. This subtle evasion tactic neutralizes Endpoint Detection and Response platforms by blinding their visibility hooks into system activity. While the security software appears to run normally within the Windows process management environment, its internal telemetry mechanisms are rendered completely deaf and unable to monitor subsequent system activities.
The tactical implications of this delivery mechanism are severe. Ontinue observed that the threat actor leverages the vulnerable driver specifically to disable monitoring protections before releasing the stealer binary, ensuring that subsequent password scraping, cryptocurrency theft, and persistence mechanisms proceed undetected by local defenses.
Testing conducted by security researchers confirmed that modern platform safeguards struggle to mitigate this specific vector. Neither Windows Hypervisor-Protected Code Integrity nor Microsoft’s current Vulnerable Driver Blocklist successfully blocked the specific PDFWKRNL.sys binary variant used in these attacks from loading into the system. This defensive blind spot persisted even though the specific cryptographic hash of the driver had already been documented and cataloged in the open-source LOLDrivers repository since March 2026.
The campaign’s initial discovery dates back to earlier reports from Arctic Wolf Labs, which documented the threat actors compromising a wide array of legitimate Ukrainian commercial and institutional websites. The compromised web assets included digital platforms belonging to a specialized hair-treatment clinic, a manufacturer of scale models, a niche bookseller, an automotive retailer, a specialized tool supplier, and a psychological health facility. Attackers compromised these sites to inject hidden iframe elements configured to display fraudulent Cloudflare CAPTCHA verification overlays. Visitors browsing these compromised platforms were confronted with the fake checks and guided through instructions that prompted them to copy and execute malicious code directly through the Windows Run dialog or PowerShell prompts, unwittingly triggering the deployment of the malicious MSI payload.
While earlier incident reports classified the resulting malicious binary as Psychedelic Stealer, cybersecurity investigators have clarified that the software is part of the commercial Lunex platform. The name "Psychedelic" reflects the internal nomenclature given to the specific compiled executable deployed on host machines, whereas Lunex represents the broader infrastructure, administrative panels, and development core marketed to affiliate cybercriminals under the malware-as-a-service model.
The historical trail of the platform traces back to June 2026, when researcher Luke Wilkinson of BlueTeamCoolTeam first observed six active command-and-control panels linked to Lunex Stealer distributed across servers located in the United States, Germany, Finland, the Netherlands, and Ukraine. Since that initial sighting, the infrastructure supporting the operation has expanded rapidly across the globe. Recent telemetry indicates the existence of at least 28 unique Lunex C2 administrative panels operating across 13 different jurisdictions, including hosting infrastructure identified in Russia, the United States, the United Kingdom, France, Germany, the Netherlands, Turkey, and Bangladesh.
An analysis of the administrative interfaces and platform codebase indicates that the software was authored by a Russian-speaking developer or development collective. The steep expansion in dedicated panels within a compressed timeframe demonstrates that Lunex is not merely a single-actor boutique toolkit, but an actively maintained and commercialized enterprise being adopted by multiple independent threat groups or distributed through structured affiliate networks.
When executed on an infected machine, the LunexStealer payload establishes outbound communications over HTTP with a central command-and-control server hosted at IP address 193.178.159[.]128. The malware initiates data exfiltration routines that target stored browser credentials, web session cookies, autofill records, and wallet files associated with multiple cryptocurrency applications.
Beyond straightforward credential theft, the malware deploys an evasive mechanism to establish long-term remote access. LunexStealer extracts a 13,200-byte PowerShell script embedded within its .rdata binary section to configure a custom Native Messaging Host within Google Chrome. By utilizing the legitimate Chrome Native Messaging protocol over standard input and standard output streams, the malicious host executes directly inside the legitimate process context of the browser.
Because the host is bound to the browser’s native messaging architecture, the backdoor survives the deletion of the original stealer executable from disk, resists system reboots, and persists across multiple browser restarts. The embedded PowerShell implementation enables operators to interact directly with the underlying host system, supporting six discrete filesystem manipulation commands that give the attackers persistent, interactive access to the victim’s local directories.
The malware cements its hold over the victim’s web environment by directly manipulating Chrome’s Secure Preferences file to force the installation of a malicious browser extension. The rogue extension is provisioned with a broad set of permissions, including access to browser tabs, web storage, system proxy settings, browsing history, stored cookies, and active bookmarks. Furthermore, the extension claims rights over dynamic scripting, the declarativeNetRequest API, and all web traffic passing through HTTP and HTTPS protocols. These elevated permissions provide the operators with total visibility into the victim’s unencrypted web sessions, enabling dynamic interception of web traffic, traffic redirection, and the real-time harvesting of newly authenticated session tokens.
The operational footprint of Lunex also extends beyond client-side credential theft and backdoor persistence. Infrastructure tracking has revealed that one of the platform’s control panels hosted on a server in Turkey actively resolves to five distinct phishing domains. This operational link indicates that the authors behind Lunex provide customers with an integrated suite of attack capabilities, combining localized credential theft, advanced system evasion, persistence utilities, and specialized web infrastructure tailored for credential phishing and corporate brand impersonation.
The convergence of consumer-grade infection vectors like ClickFix with complex evasion methods like BYOVD highlights an increasingly blurred line between opportunistic crimeware operations and advanced persistent threat tactics. By adopting kernel callback zeroing to neutralize endpoint security without triggering process termination alarms, commercial malware platforms like Lunex continue to undermine established host-based security controls, presenting ongoing visibility challenges for enterprise defenders.