Twenty-eight unique Lunex panels have been identified across 13 countries, a rapid expansion that accompanies a multifaceted information-stealing campaign aimed at Ukrainian-speaking users, Ontinue's analysis shows.
Scope of the Lunex MaaS and Psychedelic Stealer
Ontinue describes Lunex as a malware-as-a-service (MaaS) platform and says the component running on victims' machines—variously called Psychedelic or LunexStealer—is a fully featured information stealer. Rhys Downing, an Ontinue threat researcher, summarized the chain as beginning “with a fake CAPTCHA page and culminat[ing] in the deployment of a fully-featured C2 agent.” BlueTeamCoolTeam researcher Luke Wilkinson first surfaced Lunex in June 2026, noting six active Lunex Stealer C2 panels; Ontinue now counts 28 unique panels, hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh.
The infection chain: ClickFix lures, fake CAPTCHAs, and LunexLoader
Arctic Wolf Labs first documented the delivery method this week: legitimate Ukrainian websites—ranging from a hair-treatment clinic to a specialist bookseller and an automotive retailer—were compromised to inject an iframe that serves a ClickFix-style Cloudflare verification check. The lure presents a fake CAPTCHA page and delivers bogus MSI installers. Those installers trigger a loader called LunexLoader, which Ontinue says is designed to bypass User Account Control (UAC) on Windows by leveraging the CMSTPLUA COM object.
After bypassing UAC, LunexLoader downloads the stealer payload. The final-stage binary communicates with a Lunex panel at 193.178.159[.]128 over HTTP to coordinate theft and exfiltration.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildBYOVD abuse of AMD Radeon driver (CVE-2023-20598) to blind defenses
A notable and unusual element of this chain is the use of a bring-your-own-vulnerable-driver (BYOVD) technique. Lunex abuses an AMD Radeon kernel-mode driver, PDFWKRNL.sys, which Ontinue says is susceptible to CVE-2023-20598. The driver is used to escalate privileges and to “switch off security tools on the victim’s machine,” allowing the stealer to operate with reduced detection.
Ontinue highlights the implementation detail: Lunex uses PDB-guided kernel callback zeroing rather than process termination, which the researchers describe as “a quieter approach to EDR neutralisation that leaves security products running but blind.” Ontinue also reports that validated testing showed neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevented the specific PDFWKRNL.sys variant used in this chain from loading, despite the driver hash having been catalogued in the LOLDrivers project since March 2026.
What Psychedelic steals and how it persists
Once active, LunexStealer performs broad data collection. Ontinue lists seven targeted Chromium-based browsers—Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi—and says the stealer extracts credentials and session cookies. It enumerates desktop cryptocurrency wallets (Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum) and four browser-extension wallets (MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet) and exfiltrates relevant data.
Persistence mechanisms are layered: a Registry Run key, a hidden scheduled task named “psychedelicloveUtils,” and a registered Chrome native-messaging host (NMH). Ontinue explains the NMH is backed by a 13,200-byte PowerShell script embedded in the .rdata section of the host and that the script “implements the Chrome Native Messaging protocol over standard input and output.” The NMH runs in Chrome’s process context and “survives stealer binary deletion, system reboots, and browser restarts.”
The PowerShell host supports six file-system actions—list_drives, list_dir, read_file (supports reads in 512 KB chunks and files up to 524 MB), write, download, and run—and the stealer also injects a malicious Chrome extension by manipulating Chrome Secure Preferences. That extension is declared with broad permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP/HTTPS URLs, granting the operator extensive visibility and control over browser activity.
What this means for technologists and security teams, end users, and brands targeted by phishing
- Technologists and security teams: Ontinue’s findings highlight a BYOVD vector tied to PDFWKRNL.sys (CVE-2023-20598). The chain’s use of PDB-guided kernel callback zeroing and the reported failure of HVCI and Microsoft’s Vulnerable Driver Blocklist to stop the variant are concrete behaviors to monitor, as is the presence of a 13,200-byte PowerShell-backed NMH that persists inside browser processes.
- End users and the general public: Compromised Ukrainian-language websites were the initial delivery mechanism, using fake CAPTCHA/ClickFix pages and bogus MSI installers. Users should be aware that a seemingly routine site verification prompt can precede a multi-stage loader and persistent browser compromise.
- Brands and organizations used in phishing: Ontinue found one Lunex panel in Turkey resolving to five phishing domains—account-sams-club[.]com, teamwork-recover-password[.]com, namshi-uae[.]com, whatsappbusineses[.]com, and ibraq-perfumes[.]com—indicating the platform also supports brand impersonation and bulk phishing campaigns.
Ontinue’s reporting, echoed by Arctic Wolf Labs and earlier sightings from BlueTeamCoolTeam, paints Lunex as an actively expanding MaaS with a novel combination of BYOVD-driven blind spots and persistent browser-based control. The platform’s growth—from six panels reported in June 2026 to 28 panels now—suggests continued distribution and resale, and it leaves a clear, testable set of artifacts for defenders to hunt: the PDFWKRNL.sys variant of interest, the LunexLoader UAC bypass via CMSTPLUA, the 13,200-byte PowerShell NMH, and the scheduled task “psychedelicloveUtils.”
