Lunex C2 panels identified: 6 panels, 5 countries (Source: BlueTeamCoolTeam / Luke Wilkinson (June 2026))
A Platform Built to Blind Security Tools, Then Steal
Researchers at Ontinue have detailed a malware-as-a-service (MaaS) platform called Lunex that pairs a rarely-seen technique with standard credential theft: it uses a legitimate but vulnerable driver to disable security monitoring before a stealer payload ever runs. The component that executes on victim machines, called Psychedelic Stealer, is one piece of a broader platform sold to multiple criminal groups. Ontinue researcher Rhys Downing described a four-stage chain that begins with a fake CAPTCHA verification page on compromised websites and ends with a fully-featured command-and-control agent capable of extracting browser credentials and cryptocurrency wallet data.
Infrastructure Expanded Fourfold in Three Months
The platform's footprint has grown quickly since it was first catalogued. In June 2026, independent researcher Luke Wilkinson of BlueTeamCoolTeam identified six active Lunex command-and-control panels. By September, Ontinue counted 28 unique panels spread across a wider set of countries.
Downing attributed the platform to a Russian-speaking developer or team and noted the growth pattern is consistent with either a single operator scaling up or the platform being resold to other actors. One panel hosted in Turkey was found resolving to five separate phishing domains, indicating the platform's use extends beyond credential theft into brand impersonation.
The Driver Trick That Current Defenses Miss
Before the stealer deploys, a loader called LunexLoader bypasses Windows User Account Control using the CMSTPLUA COM object, then loads a vulnerable AMD Radeon Software kernel-mode driver ('PDFWKRNL.sys'), affected by CVE-2023-20598, to escalate privileges. Rather than terminating security processes outright, the technique uses what Ontinue described as 'PDB-guided kernel callback zeroing' — leaving antivirus and EDR products appearing to run normally while their visibility is cut. Ontinue's testing found that neither Microsoft's Hypervisor-protected Code Integrity (HVCI) nor its Vulnerable Driver Blocklist stops this specific driver variant from loading, even though the driver's hash has been catalogued in the LOLDrivers project since March 2026.
What Gets Stolen, and How It Survives
Once security monitoring is degraded, the stealer harvests credentials and session data from Chromium-based browsers and targets both desktop and browser-extension cryptocurrency wallets.
Persistence is maintained through a registry Run key, a hidden scheduled task, and a PowerShell-based Native Messaging Host (NMH) registered inside the browser — a 13,200-byte script embedded in the malware's .rdata section that communicates using Chrome's Native Messaging protocol. Because it operates within Chrome's own process context, Ontinue found the NMH survives deletion of the original stealer binary, system reboots, and browser restarts, and it can still read, write, and download arbitrary files from the infected machine.
What Budget-Holders Should Ask
This is one documented campaign, currently focused on Ukrainian-speaking users through compromised legitimate websites, but the underlying technique — degrading security tooling via a catalogued, blocklisted driver that still loads — is a defense gap worth checking regardless of geography. Ask your security team whether your EDR or antivirus vendor can detect kernel callback tampering rather than only process termination or crashes. Ask whether your organization relies solely on Microsoft's Vulnerable Driver Blocklist and HVCI for this class of attack, given researchers found a cataloged driver hash still loading six months after being listed. Ask whether browser Secure Preferences files and native-messaging host registrations are monitored for unauthorized changes, since that is how this platform maintains access after the original malware is removed.
