Unmasking Lunex: How Compromised Ukrainian Websites and Advanced BYOVD Tactics Fuel a Growing Malware-as-a-Service Empire

The cybersecurity landscape faces a sophisticated new threat as researchers uncover deep connections between a string of cyberattacks targeting Ukrainian-speaking internet users and a rapidly expanding Malware-as-a-Service (MaaS) ecosystem known as Lunex. Initially spotted utilizing deceptive, ClickFix-style Cloudflare verification pages injected into compromised local websites, the underlying campaign deploys a potent information-stealing payload frequently referred to in telemetry reports as Psychedelic Stealer or LunexStealer.

Recent technical findings from cybersecurity firms Ontinue and Arctic Wolf Labs have shed light on the mechanics of this multi-stage attack chain. The operation is meticulously structured to bypass standard endpoint detection and response (EDR) solutions, compromise mainstream web browsers, vacuum sensitive personal and financial data, and establish persistent backdoor access via a native messaging host. The rapid international proliferation of Lunex command-and-control (C2) infrastructure highlights the commercialization and professionalization of modern cybercrime, where modular toolsets are routinely leased or sold to disparate threat actor groups worldwide.

Anatomy of an Attack: The Four-Stage Infection Chain

The infection vector relies heavily on social engineering, targeting visitors to otherwise legitimate, trusted Ukrainian websites. Documented targets include regional businesses spanning specialized book retailers, psychological support facilities, automotive dealerships, tool supply shops, hair treatment clinics, and scale-model manufacturers. Threat actors successfully inject malicious iframe elements into these platforms, confronting unsuspecting visitors with fake security verification prompts modeled after legitimate Cloudflare CAPTCHA interfaces.

When users interact with these fraudulent prompts—often persuaded to execute a manual troubleshooting step popularized by ClickFix techniques—they inadvertently download a malicious Microsoft Software Installer (MSI) package. This triggers a four-stage execution pipeline designed to slip past modern security perimeters.

First, a custom loader designated as LunexLoader executes, leveraging the CMSTPLUA COM object to elevate privileges by bypassing Windows User Account Control (UAC). Second, the loader employs a Bring Your Own Vulnerable Driver (BYOVD) attack vector to blind security tools before finally deploying the information-stealer payload.

"The attack chain begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent," explained Rhys Downing, a threat researcher at Ontinue. "The stealer extracts credentials and data from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access through a PowerShell-based Native Messaging Host installed within the victim’s browser."

Evading Defenses via Bring Your Own Vulnerable Driver (BYOVD)

One of the most concerning aspects of the Lunex framework is its reliance on kernel-level manipulation to evade detection, a tactic historically associated with advanced persistent threat (APT) groups rather than commodity information stealers.

To achieve defense evasion, the Lunex delivery chain incorporates a legitimate yet vulnerable kernel-mode driver associated with AMD Radeon Software, specifically cataloged under the filename PDFWKRNL.sys. This driver contains a known vulnerability tracked as CVE-2023-20598. By loading this vulnerable driver into the Windows kernel, the malware gains the capability to escalate privileges and systematically neutralize or blind security software—such as EDR and antivirus agents—leaving them technically running in the task manager but entirely non-functional.

Security analysts emphasize that this approach represents a significantly quieter methodology than attempting to violently terminate security processes, which often triggers immediate behavioral alerts. Instead, the malware utilizes PDB-guided kernel callback zeroing to silently neuter active defenses.

Disturbingly, Ontinue’s validation testing revealed that neither Hypervisor-Protected Code Integrity (HVCI) nor Microsoft’s default Vulnerable Driver Blocklist successfully prevents this specific variant of PDFWKRNL.sys from loading. This oversight persists despite the driver’s hash having been catalogued in open-source tracking projects like LOLDrivers since early 2026, pointing to a persistent gap in modern operating system-level hardening against BYOVD exploits.

From Psychedelic Stealer to LunexStealer: Unraveling the MaaS Platform

The nomenclature surrounding this threat family has evolved alongside public research. The initial wave of discoveries, published by Arctic Wolf Labs, focused on the final-stage artifact dubbed "Psychedelic Stealer." Subsequent investigations by independent researchers, including Luke Wilkinson of BlueTeamCoolTeam, illuminated the broader infrastructure, identifying active command-and-control panels communicating with a centralized MaaS platform known as Lunex.

Industry analysts have clarified that "Psychedelic" designates the specific binary executable running locally on an infected workstation, whereas "Lunex" or "LunexStealer" references the overarching framework being monetized and distributed across cybercriminal underground forums.

Upon successful execution, the stealer establishes continuous communication over HTTP with C2 infrastructure—such as an active node hosted at IP address 193.178.159[.]128—to report telemetry and upload harvested datasets. The malware is engineered to systematically harvest saved passwords, session cookies, autofill data, and cryptocurrency wallet extensions from at least seven distinct Chromium-based browsers.

Persistence Through Browser-Native Mechanisms

Beyond immediate data harvesting, LunexStealer establishes deep, long-term persistence that withstands standard remediation efforts, including basic malware removal or system reboots. This is accomplished via a PowerShell-based Native Messaging Host (NMH) embedded directly into the .rdata section of the binary, measuring roughly 13,200 bytes.

The NMH implements the standard Chrome Native Messaging protocol over standard input and output streams, operating transparently within the active browser process context. Because it relies on legitimate browser integration channels, the script survives the deletion of the primary stealer binary and persists through system restarts.

Furthermore, the PowerShell script supports extensive local file system operations, granting operators remote file management capabilities. To maintain continuous visibility over web traffic and user sessions, LunexStealer modifies Chrome’s Secure Preferences file to force the installation of a malicious browser extension. This extension demands sweeping permissions—including access to cookies, browsing history, bookmarks, tabs, local storage, proxy settings, and script injection capabilities across all HTTP and HTTPS domains—effectively handing over complete control of the victim’s web activity to the attackers.

Global Expansion and Attribution Insights

Telemetry gathered regarding the Lunex C2 panels highlights an aggressive expansion strategy. While initial OSINT findings in June 2026 identified just six active panels distributed across countries including the United States, Finland, Germany, the Netherlands, and Ukraine, subsequent research revealed a staggering increase.

By late 2026, security analysts mapped 28 unique Lunex panels spread across 13 distinct countries. Infrastructure has been detected in major jurisdictions including Russia, the United States, the United Kingdom, the Netherlands, France, Germany, Turkey, and Bangladesh. Code artifacts, string analysis, and operational infrastructure points strongly toward a Russian-speaking development team behind the platform’s core architecture.

The rapid geographical diversification of these control nodes underscores the commercial viability of the MaaS offering. Rather than being deployed by a single, isolated threat group, Lunex is actively leased or sold to multiple independent cybercrime operations, each adapting the framework to suit their respective targeting campaigns.

Moreover, investigations into specific infrastructure nodes have revealed broader utility beyond mere information theft. For instance, analysis of a C2 panel hosted in Turkey uncovered domain-resolution maps linking the infrastructure to active phishing sites designed for brand impersonation and credential harvesting, demonstrating that the platform’s operators continuously expand its modular capabilities.

Implications for Enterprise and Personal Security

The rise of platforms like Lunex marks a concerning evolution in the cybercrime economy, blurring the lines between commodity malware and advanced, state-like evasion tactics. By democratizing access to complex kernel-level exploits such as BYOVD and integrating deep browser-level persistence mechanisms, low-skilled threat actors are equipped with capabilities traditionally reserved for sophisticated espionage groups.

Cybersecurity experts recommend that organizations and individual users maintain heightened vigilance against deceptive verification prompts, particularly those mimicking Cloudflare or other security services on unfamiliar websites. Network administrators are advised to audit endpoint security configurations rigorously, verify that driver blocklists are updated through alternative hardening frameworks where default controls fall short, and monitor for unauthorized modifications to browser preference files and native messaging manifests.

As the Lunex ecosystem continues to evolve and scale its international footprint, security researchers stress that proactive threat intelligence sharing and rapid patching of vulnerable kernel drivers remain critical lines of defense in mitigating the impact of modern Malware-as-a-Service operations.