Lunex Stealer Uses AMD Driver to Disable Monitoring and Steals Credentials

A new strain of the Lunex malware-as-a-service platform was uncovered by researchers at Ontinue. The tool distributes itself through compromised Ukrainian websites that employ ClickFix‑style Cloudflare verification checks. When a user visits one of these sites, the attacker injects JavaScript into the legitimate page, redirecting the visitor to a malicious CAPTCHA interface that looks like a normal human-verification prompt but actually captures typed credentials instead of checking for humanity. This technique is similar to earlier credential-harvesting campaigns against cryptocurrency exchanges, but it now employs more advanced evasion because detection mechanisms have improved significantly over the past decade.¹

The attack chain is organized in four stages aimed at Ukrainian-speaking users. Stage one begins with the fake CAPTCHA page described above. Subsequent steps load a custom AMD kernel driver signed by the OEM, bypassing integrity checks and allowing code to run with elevated system privileges. If loaded, the malware disables existing security‑monitoring tools—such as host intrusion prevention systems or endpoint protection agents—and harvests stored browser passwords from local credential stores. All of these facts were reported directly by Ontinue’s analysis.¹

From an expert perspective, using a trusted AMD driver introduces severe privilege‑elevation concerns. Malware executing within such a driver gains broader access across the operating system than ordinary user processes would possess, enabling stealthy persistence and data exfiltration. The Lunex Stealer therefore represents a new class of attacks that leverage legitimate hardware drivers to evade detection while harvesting sensitive credentials.

Implications for online privacy are significant. By disabling monitoring software the attacker removes one line of defence against further exploitation. Stolen browser credentials can lead to account takeover, phishing, or lateral movement into corporate networks via social engineering. Users who rely on single-factor authentication become especially vulnerable because stolen passwords provide direct entry points. Moreover, because the malicious driver is signed many antivirus engines may not flag it initially, giving attackers additional time in the victim environment.

Mitigation strategies focus on technical controls and user behaviour. System administrators ought to audit kernel module loads regularly, ensuring only authorised drivers appear in the boot sequence. Endpoint solutions must check anomalous driver signatures and enforce least-privilege principles so even trusted modules cannot disable other security tools. End users should keep operating systems updated, avoid suspicious websites, and enable multi-factor authentication on browsers to reduce exposure. Finally organisations should review third-party code injection points—such as those used by Cloudflare verification checks—to minimise the attack surface available to malware authors.

In summary, Lunex’s new variant demonstrates a shift toward using privileged hardware drivers for stealthy credential theft. The combination of legitimate driver signing, sophisticated JavaScript injection, and fake CAPTCHA interfaces creates a potent threat vector that bypasses conventional detection mechanisms. Vigilance at every layer—from OS updates to endpoint monitoring—is essential to counter this evolving risk.