Lunex Stealer Uses AMD Drivers to Bypass Security
Introduction
The latest intelligence from Ontinue reveals that the Lunex Stealer, a modular malware‑as‑a‑service (MaaS) platform, is being distributed through compromised Ukrainian web pages that employ click‑fix style Cloudflare verification challenges. The campaign is deliberately engineered to lure Ukrainian‑speaking internet users into a deceptive environment where a counterfeit CAPTCHA appears, prompting them to click a button that covertly executes malicious code. Once the payload is in place, the malware disables security monitoring mechanisms and proceeds to harvest browser credentials, illustrating a sophisticated, multi‑stage approach that blends social engineering with low‑level system compromise.
Exploiting AMD Graphics Drivers to Bypass Security Controls
The heart of this operation is the strategic abuse of a legitimate AMD graphics driver that is digitally signed by the vendor. By embedding a malicious payload within the driver’s installation files, the attackers gain kernel‑level execution privileges, allowing them to subvert core protection mechanisms such as real‑time antivirus scanning, firewall enforcement, and system telemetry monitoring. The malicious code hijacks critical entry points in the driver’s initialization routine, effectively creating a stealthy backdoor that persists across reboots. In addition to disabling security services, the injected component can intercept and filter network traffic, ensuring that exfiltrated credentials remain hidden from traditional endpoint detection tools. This approach exemplifies a “living‑off‑the‑land” technique, where trusted system components are weaponized to evade detection and maintain long‑term persistence without the need for separate persistence mechanisms.
- The malicious module modifies the driver’s entry routine to insert a covert hook.
- It disables Windows Defender’s cloud‑based protection and real‑time monitoring services.
- It injects a packet‑filtering layer that conceals outbound communications from security tools.
- It leverages AMD’s own code‑signing certificate to bypass kernel‑level integrity checks.
Four‑Stage Attack Chain Directed at Ukrainian Users
The campaign follows a tightly orchestrated sequence designed to evade detection while maximizing the theft of browser credentials. Each phase builds upon the previous one, creating a seamless user experience that masks malicious intent.
- Fake CAPTCHA landing page: a counterfeit verification screen mimics legitimate sites, prompting the victim to interact.
- Click‑fix verification bypass: the page exploits a timing flaw in the challenge, causing the browser to automatically solve the puzzle. This action triggers the loading of a malicious JavaScript payload that runs in the context of the victim’s session.
- Stealthy payload delivery: the script silently downloads a compressed executable, often packed with UPX or similar obfuscation, which masquerades as a benign update for the graphics driver or a system utility. Once executed, the payload establishes persistence through scheduled tasks or registry modifications.
- Credential exfiltration: the final stage captures saved passwords, cookies, autofill entries, and form data from popular browsers such as Chrome, Edge, and Firefox. The harvested information is then encrypted and sent to command‑and‑control servers via covert channels, often masquerading as routine HTTP traffic.
Grivyonx Expert Analysis
The convergence of driver‑level compromise with a multi‑stage phishing front‑end demonstrates a sophisticated evolution in malware delivery models. By embedding malicious code within a trusted AMD graphics driver, the threat actor achieves kernel‑mode execution without the need for separate exploit kits, dramatically reducing the attack surface for traditional defenses. This “living‑off‑the‑land” strategy is increasingly popular among MaaS operators, as it leverages existing system components to bypass signature‑based detection and to maintain persistence across system updates. The four‑stage flow further illustrates how social engineering can be seamlessly integrated with low‑level system manipulation, creating a scalable infrastructure that can be replicated across diverse geographic regions. For defenders, the key implications are clear: continuous monitoring of driver integrity, deep inspection of kernel‑mode activity, and behavior‑based anomaly detection are essential. AI‑enhanced security platforms can automatically flag anomalous driver modifications, rapid credential dumping, and unusual network patterns, providing the early warning needed to mitigate such sophisticated attacks before widespread credential loss occurs.
Conclusion
These findings underscore the critical need for deep, behavior‑centric security controls that go beyond superficial signature checks. The ability of the Lunex Stealer to subvert AMD driver signing, evade real‑time protection, and harvest credentials in a multi‑stage fashion reflects a broader trend where attackers blend user‑facing deception with low‑level system subversion. As such threats proliferate, organizations must adopt proactive, intelligence‑rich monitoring that can detect subtle anomalies in driver behavior and rapid credential exfiltration. Grivyonx Cloud’s AI‑driven automation excels at identifying these subtle indicators, enabling swift, automated response without the need for intrusive sales tactics, thereby reinforcing a resilient security posture in today’s complex threat environment.
- #malware
- #Lunex
- #AMD driver
- #credential theft
- #Ukraine
- #MaaS
- #phishing
- #cybersecurity
