Lunex MaaS Platform Exploits AMD Drivers to Deploy Psychedelic Stealer

According to Ontinue, the Lunex malware-as-a-service platform has been observed conducting campaigns targeting users in Ukraine. The attack begins when a victim visits a compromised website hosting a fake CAPTCHA prompt. Interacting with the CAPTCHA triggers a ClickFix-style social engineering sequence that abuses Cloudflare verification checks to evade bot detection. This initial access leads to a multi-stage payload delivery chain.

The Psychedelic Stealer payload is designed to abuse AMD graphics drivers. Ontinue's analysis indicates the malware leverages specific AMD driver capabilities to interfere with security monitoring processes, effectively disabling or bypassing security software running on the host. Beyond disabling defenses, the stealer exfiltrates stored browser credentials, session cookies, and other sensitive data from infected browsers.

The four-stage chain typically involves: initial delivery via the fake CAPTCHA, execution of a loader component, driver-level interference via AMD APIs, and finally, credential exfiltration and system reconnaissance. The use of legitimate AMD drivers in this manner represents a technique to bypass security controls that rely on process monitoring or behavioral analysis.

Ontinue notes that the campaign appears financially motivated, leveraging the MaaS model to allow other threat actors to deploy the stealer in exchange for a share of the profits. The targeting of Ukrainian-speaking users suggests a regional focus, possibly aligned with geopolitical interests, though the global distribution of the MaaS platform means any user interacting with compromised sites could be at risk.