Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and

The report describes Lunex, a malware-as-a-service platform that uses fake Cloudflare verification pages, a vulnerable AMD driver, and defense-evasion techniques before deploying a stealer that captures browser passwords, session cookies, cryptocurrency-wallet data, and files. The activity is conventional endpoint malware and does not directly involve an AI system, model, or AI agent. RealGround analysis: the closest permitted classification is data leakage because the malware exfiltrates sensitive credentials and session data; the mapped services can help assess organizational exposure, governance, and controls, but this mapping is indirect.