Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Lunex Stealer has resurfaced, leveraging a compromised AMD driver to turn off security monitoring while siphoning browser credentials, a move that directly threatens anyone using AMD hardware and modern browsers. The attack chain, uncovered by security firm Ontinue, starts with a counterfeit CAPTCHA page and proceeds through four distinct stages before exfiltrating data. Understanding how this chain operates and why the driver abuse is effective is essential for anyone who values digital privacy and wants to keep their credentials safe.
Lunex as a Malware‑as‑a‑Service Platform
The campaign is built on a broader Lunex malware‑as‑a‑service (MaaS) infrastructure that packages malicious components for resale to low‑skill actors. By distributing the payload through compromised Ukrainian websites that mimic legitimate Cloudflare verification checks, the operators achieve a high degree of reach without needing sophisticated phishing infrastructure. This model lowers the entry barrier for attackers, allowing them to focus on targeting rather than development.
Ontimize’s analysis shows the service automatically injects the stealer into any visitor who passes the fake verification, meaning the infection vector is effectively invisible to casual users. The reliance on a shared platform also means updates and new capabilities can be pushed to all subscribers instantly, keeping the threat adaptable. As a result, defenders face a moving target that can evolve faster than traditional, bespoke malware families.
The targeting logic is tuned to Ukrainian‑speaking audiences, reflecting the origin of the compromised sites and the language of the fake CAPTCHA prompts. This geographic focus suggests a strategic intent, possibly aligning with regional espionage or financially motivated campaigns that exploit local trust. For users outside the region, the risk remains because the same infrastructure can be repurposed for broader attacks.
Abusing the AMD Driver to Neutralize Defenses
At the core of the operation is an exploitation of an AMD driver that grants the malware kernel‑level privileges, allowing it to disable security monitoring components that would normally flag suspicious activity. By tampering with the driver’s initialization routine, Lunex can silently turn off antivirus hooks and event logging, creating a blind spot for the rest of the infection chain. This approach bypasses user‑space defenses that rely on standard API calls.
Driver‑level abuse is particularly potent because it operates beneath the operating system’s typical security abstractions, making detection by conventional anti‑malware tools difficult. The compromised driver continues to load at boot, ensuring persistence even after system reboots or user‑initiated scans. Consequently, the malware maintains a foothold that survives many common remediation attempts.
Because the driver is signed by AMD, many security solutions trust its legitimacy, inadvertently granting the malicious code a veneer of authenticity. This trust relationship complicates incident response, as analysts must differentiate between legitimate driver updates and malicious modifications. The result is a prolonged window of exposure before the intrusion is finally uncovered.
Stealing Browser Credentials Through a Fake CAPTCHA
The infection begins with a fake CAPTCHA page that mimics Cloudflare’s ClickFix verification, luring users into believing they are completing a routine security check. Once the user interacts with the counterfeit challenge, the malicious script initiates the four‑stage attack chain that culminates in credential harvesting. Each stage builds on the previous one, from driver compromise to disabling monitoring, and finally to data exfiltration.
In the final stage, the stealer scans the victim’s browser storage for saved passwords, session cookies, and autofill data, extracting them into an encrypted payload that is sent to a command‑and‑control server. Because the driver has already silenced security alerts, the browser’s own defenses are unable to flag the unauthorized access. The stolen credentials can then be used for account takeover, financial fraud, or further lateral movement within corporate networks.
The impact extends beyond individual accounts; compromised browsers often hold corporate single sign‑on tokens, meaning a single infection can cascade into a broader breach. Moreover, the use of a familiar CAPTCHA interface reduces user suspicion, increasing the success rate of the initial compromise. This blend of social engineering and low‑level system abuse creates a potent combination that is hard to mitigate without layered defenses.
What This Actually Means For You
- Even up‑to‑date browsers are vulnerable if the underlying hardware driver is compromised, so credential theft can occur without any obvious malware warning.
- The fake CAPTCHA technique shows that visual trust cues are no longer sufficient; users must verify URLs and certificate details before interacting.
- Malware‑as‑a‑service platforms like Lunex enable rapid weaponization of existing vulnerabilities, meaning new variants can appear faster than patch cycles.
- Driver‑level attacks exploit the trust placed in signed hardware components, highlighting the need for strict driver verification and monitoring.
- Regional targeting does not guarantee safety for users outside the focus area, as the same infrastructure can be repurposed for global campaigns.
Immediate Action Steps
Begin by confirming that your AMD drivers are sourced directly from the official vendor and that automatic updates are enabled; avoid third‑party driver repositories that could introduce tampered binaries. If you suspect a compromised driver, use a reputable anti‑malware tool that offers kernel‑level scanning, and consider rolling back to a known good driver version.
Next, scrutinize any web page that presents a CAPTCHA challenge, especially those that appear after a Cloudflare verification prompt; verify the domain’s SSL certificate and avoid entering any data on pages that feel out of place. Finally, enable multi‑factor authentication on all accounts that store sensitive credentials in browsers, reducing the damage potential if a password is exfiltrated.
Frequently Asked Questions
How does Lunex Stealer disable security monitoring?
Lunex injects malicious code into a legitimate AMD driver, altering its initialization routine to turn off antivirus hooks and event logging, effectively blinding standard security tools.
What are the four stages of the Lunex attack chain?
The chain starts with a fake CAPTCHA page, proceeds to driver compromise, then disables security monitoring, and finally harvests browser credentials for exfiltration.
Can the AMD driver abuse be prevented?
Prevention relies on using only vendor‑signed drivers, keeping them updated, and employing security solutions that can scan at the kernel level to detect unauthorized driver modifications.
What Do You Think?
Given the ease with which a signed hardware driver can be weaponized, should hardware manufacturers rethink the trust model that allows drivers such deep system access?