Lunex MaaS Deploys PDFWKRNL.sys via CVE-2023-20598 to Blind EDR Before Stealer Payload

The four-stage chain starts with compromised Ukrainian sites serving ClickFix lures that deliver MSI installers. These trigger UAC bypass via CMSTPLUA COM, load LunexLoader, exploit the vulnerable AMD kernel driver for privilege escalation and selective process blinding, then fetch the final stealer. Ontinue telemetry shows the loader keeps EDR agents alive in Task Manager while stripping their monitoring hooks. BlueTeamCoolTeam tracked six active Lunex C2 panels across five countries as early as June 2026.

Evidence from Arctic Wolf Labs and Ontinue reports confirms the stealer targets seven Chromium browsers for credentials and cookies, five desktop wallets, and four browser-extension wallets. Persistence uses a Registry Run key, a scheduled task named psychedelicloveUtils, and a 13,200-byte PowerShell Native Messaging Host registered inside Chrome. The NMH survives binary deletion and reboot, enabling continued filesystem access after the initial payload is removed.

BYOVD techniques have historically appeared in ransomware or nation-state toolkits; their use here as a precursor to commodity information theft marks an escalation in MaaS capability. The driver choice is narrow—only AMD Radeon Software installs are affected—yet the pattern of embedding vulnerable signed drivers in loaders is spreading. Procurement records for similar kernel drivers remain sparse, complicating preemptive blocklisting.

Next steps include wider abuse of the same AMD driver in other MaaS families and possible migration to additional vulnerable AMD or NVIDIA binaries once this one is sinkholed. Defenders should monitor for unsigned or mismatched PDFWKRNL.sys loads alongside ClickFix delivery domains.