Lunex Stealer Uses Malicious AMD Driver to Shut Down Security Tools and Harvest Browser Passwords
What Happened — Researchers at Ontinue uncovered a new variant of the Lunex “MaaS” stealer that loads a malicious AMD driver to disable endpoint security sensors before dumping saved browser credentials. The campaign is delivered through compromised Ukrainian sites that present a fake CAPTCHA/Cloudflare verification page to lure victims.
Why It Matters for Trust & Control Assurance
- Demonstrates how threat actors can bypass traditional AV/EDR by tampering with low‑level drivers, highlighting the need for continuous, tamper‑resistant monitoring controls.
- Shows that credential‑theft attacks often start with social‑engineering lures, underscoring the importance of evidence‑driven security awareness and verification of user‑facing flows.
- Aligns with the control objective of “Monitoring and detection of malicious activity” – a single VCF control that satisfies multiple frameworks (e.g., NIST CSF Detect).
Who Is Affected – Primarily users of Windows PCs in Eastern Europe, but any organization with employees using vulnerable AMD drivers is at risk.
Recommended Actions
- Verify that endpoint protection solutions employ kernel‑mode integrity checks and cannot be disabled by unsigned drivers.
- Harden web‑facing applications against fake CAPTCHA abuse; enforce multi‑factor authentication for credential‑rich services.
- Map the “monitoring & detection” control to your audit framework and collect continuous evidence of its operation.
Technical Notes – The attack chain: (1) compromised site serves a fake CAPTCHA page, (2) user interaction triggers download of a malicious driver bundle, (3) driver disables security sensors, (4) stealer extracts Chrome/Edge/Firefox password stores. No specific CVE is cited; the abuse leverages legitimate AMD driver signing to evade detection.
Source: The Hacker News