Full Report
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aimed at targeting Ukrainian-speaking users. "The attack chain begins with a fake CAPTCHA page and
Analysis Summary
# Tool/Technique: Lunex (aka Psychedelic Stealer)
## Overview
Lunex is a comprehensive Malware-as-a-Service (MaaS) platform designed for information theft and persistent remote access. Distributed primarily through compromised websites using "ClickFix" lures (fake CAPTCHA/Cloudflare verification), it utilizes a sophisticated four-stage attack chain. A distinguishing feature of this malware is its use of a Bring Your Own Vulnerable Driver (BYOVD) technique to disable security products before deploying the final stealer payload.
## Technical Details
- **Type:** Malware Family / MaaS Platform
- **Platform:** Windows (Targeting Chromium-based browsers and crypto wallets)
- **Capabilities:** Credential theft, cryptocurrency exfiltration, defense evasion (BYOVD), UAC bypass, and persistent remote filesystem access.
- **First Seen:** June 2026 (Initial C2 panel discovery)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise] (Fake CAPTCHA/ClickFix via compromised sites)
- **[TA0004 - Privilege Escalation]**
- [T1548.002 - Bypass User Account Control] (via CMSTPLUA COM object)
- [T1068 - Exploitation for Privilege Escalation] (via vulnerable AMD driver)
- **[TA0005 - Defense Evasion]**
- [T1068 - Exploitation for Privilege Escalation] (BYOVD to blind security tools)
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- **[TA0003 - Persistence]**
- [T1547.001 - Registry Run Keys / Startup Folder]
- [T1053.005 - Scheduled Task]
- [T1176 - Browser Extensions] (Native Messaging Host implementation)
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Browser Data Theft:** Extracts credentials, session cookies, and data from seven Chromium-based browsers (Chrome, Edge, Brave, Yandex, Opera, Opera GX, Vivaldi).
- **Crypto Exfiltration:** Targets desktop wallets (Bitcoin Core, Litecoin, Exodus, Atomic, Electrum) and browser extension wallets (MetaMask, OKX, SafePal).
- **Native Messaging Host (NMH):** Installs a PowerShell-based NMH within Chrome to maintain a persistent bridge between the browser and the host filesystem.
### Advanced Features
- **BYOVD Attack:** Deploys a vulnerable AMD Radeon driver (`PDFWKRNL.sys`) to escalate privileges and "blind" security monitoring processes while allowing them to appear as if they are still running.
- **UAC Bypass:** Uses the `LunexLoader` component to bypass Windows User Account Control via the `CMSTPLUA` COM interface.
- **Multi-Stage Persistence:** Combines Registry Run keys, hidden scheduled tasks (`psychedelicloveUtils`), and browser-native messaging scripts to ensure survival across reboots and binary deletion.
## Indicators of Compromise
- **File Names:** `psychedelic`, `LunexLoader`, `PDFWKRNL.sys`
- **Registry Keys:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Psychedelic entry)
- **Scheduled Tasks:** `psychedelicloveUtils`
- **Network Indicators:**
- `193.178.159[.]128` (C2 Panel)
- **Behavioral Indicators:** Execution of PowerShell scripts via standard input/output within the context of `chrome.exe`.
## Associated Threat Actors
- Distributed as a MaaS; used by multiple unidentified criminal groups targeting Ukrainian-speaking users.
## Detection Methods
- **Behavioral Detection:** Monitor for the loading of known vulnerable drivers (e.g., `PDFWKRNL.sys`) by non-system processes.
- **Process Monitoring:** Audit for `powershell.exe` being spawned or communicating via stdin/stdout with browser processes (Native Messaging).
- **Registry Monitoring:** Watch for new entries in Native Messaging Host registry paths (e.g., `HKCU\Software\Google\Chrome\NativeMessagingHosts`).
## Mitigation Strategies
- **Driver Blocklisting:** Implement Microsoft’s vulnerable driver blocklist or use EDR solutions to prevent the loading of known vulnerable drivers.
- **User Training:** Educate users to recognize "ClickFix" lures, specifically fake "Verification" or "CAPTCHA" prompts that require downloading and running files.
- **Restrict PowerShell:** Enforce PowerShell Constrained Language Mode and monitor script execution logs (Event ID 4104).
## Related Tools/Techniques
- **ClickFix:** The social engineering framework used for delivery.
- **Psychedelic Stealer:** The specific payload name for the resident binary.
- **BYOVD:** Technique commonly used by APTs, now adopted by MaaS platforms like Lunex.