A malware called Psychedelic Stealer has been spreading through compromised Ukrainian websites, using fake Cloudflare verification checks to trick visitors, and new research shows it is not a standalone operation but part of a wider malware-as-a-service platform called Lunex.

Ontinue published the findings, describing the activity as a four-stage attack chain aimed at Ukrainian-speaking users, and the chain begins with a fake CAPTCHA page and ends with a fully featured command-and-control agent running on the victim's machine.

Rhys Downing, a threat researcher at Ontinue, said the stealer extracts credentials and data from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and establishes persistent remote filesystem access through a PowerShell-based Native Messaging Host installed inside the victim's browser.

Quick Summary

How the Attack Unfolds

The infection uses bogus MSI installers delivered through ClickFix, and those installers trigger a chain of actions that begins with a loader called LunexLoader.

That loader is built to bypass User Account Control on Windows using the CMSTPLUA COM object, then it leverages a bring your own vulnerable driver attack for defense evasion, and finally it downloads the stealer payload.

The use of BYOVD here is notable, because it is rarely used as a stepping stone to something as ordinary as an information stealer, and Lunex takes advantage of a vulnerable kernel-mode driver for AMD Radeon Software called PDFWKRNL.sys, which is susceptible to CVE-2023-20598.

That driver lets the malware escalate privileges and blind security-related processes while keeping them running, which is a quieter approach than simply killing them, because the security tools appear healthy even though they are effectively blind.

The Compromised Websites

Psychedelic Stealer was first documented earlier this week by Arctic Wolf Labs, which detailed how the threat actor compromised legitimate websites belonging to a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer.

Those sites were modified to inject an iframe element designed to serve the ClickFix lure, so visitors saw a fake verification prompt and were walked into running a command that installed the malware.

Downing told The Hacker News that before the stealer is delivered, the malware is designed to use a legitimate but vulnerable driver to switch off security tools on the victim's machine, and once those protections are disabled, the stealer is deployed to take browser passwords, session cookies, and cryptocurrency wallet data.

The Lunex Platform Behind It

The earliest reference to Lunex in cybersecurity literature dates back to June 2026, when Luke Wilkinson from BlueTeamCoolTeam identified six active Lunex command-and-control panels across the U.S., Finland, Germany, the Netherlands, and Ukraine.

It is worth clarifying that Psychedelic Stealer and LunexStealer refer to the same component of the MaaS platform, because Psychedelic is the name of the malware file that runs on victims' devices, while Lunex is the underlying platform being sold to multiple criminal groups.

That distinction matters, because it explains why the same payload shows up under different names depending on who is describing it, and it also explains why the platform is expanding so quickly.

What the Stealer Actually Does

Once it runs, LunexStealer communicates with the Lunex panel at 193.178.159[.]128 over HTTP, and it performs a wide range of information theft.

It steals credentials from Google Chrome, Microsoft Edge, Brave, Yandex Browser, Opera, Opera GX, and Vivaldi, and it enumerates five desktop cryptocurrency wallets, including Bitcoin Core, Litecoin, Exodus, Atomic Wallet, and Electrum, plus four browser extension wallets, including MetaMask, MetaMask Legacy, OKX Wallet, and SafePal Wallet.

Then it establishes persistence in three ways, using a Registry Run key, a hidden scheduled task named psychedelicloveUtils, and a Chrome native-messaging bridge or host that allows the stealer to perform additional actions.

Downing explained that the host is backed by a 13,200-byte PowerShell script embedded in the .rdata section, and that script implements the Chrome Native Messaging protocol over standard input and output, operating inside Chrome's process context, which means it survives stealer binary deletion, system reboots, and browser restarts.

The PowerShell script supports six filesystem actions, including list_drives to enumerate all drive letters, list_dir to list directory contents with file sizes, read_file to read arbitrary files in 512 KB chunks up to 524 MB, write to write arbitrary data to any path, download to pull files from the system, and run to execute arbitrary programs.

So the stealer does not just steal once, it leaves behind a browser-based backdoor that persists independently.

The Malicious Chrome Extension

LunexStealer also injects a malicious Chrome extension by manipulating Chrome Secure Preferences, and it declares extensive permissions for cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP and HTTPS URLs.

That grants the extension complete visibility and control over a victim's browser activity, which means everything from session cookies to browsing patterns is exposed.

Who Is Behind It

Analysis of the Lunex panel points to a Russian-speaking developer or development team, and researchers identified 28 unique panels across 13 countries, which is a major expansion from the six panels seen in June 2026.

Those panels are hosted in Russia, the U.S., the U.K., the Netherlands, France, Germany, Turkey, and Bangladesh, and Downing said that growth in just a few months shows the platform is actively expanding and being used by either one threat actor or sold to other actors, not just a single operator.

One panel hosted in Turkey resolves to five phishing domains, including account-sams-club[.]com, teamwork-recover-password[.]com, namshi-uae[.]com, whatsappbusineses[.]com, and ibraq-perfumes[.]com, which indicates the platform's feature set extends beyond credential theft to brand impersonation and phishing.

So Lunex is not just a stealer, it is a full criminal toolkit being rented out to whoever wants it.

The EDR Evasion Problem

Ontinue noted that the BYOVD delivery chain uses PDB-guided kernel callback zeroing rather than process termination, which represents a quieter approach to EDR neutralization that leaves security products running but blind.

Validated testing demonstrated that neither HVCI nor the current Microsoft Vulnerable Driver Blocklist prevents the specific PDFWKRNL.sys variant used in this chain from loading, and that gap persists despite the driver hash being catalogued in the LOLDrivers project since March 2026.

That is a problem, because it means the usual defenses against vulnerable driver abuse are not catching this variant, and defenders need to look for behavioral signs rather than relying on blocklists alone.

What You Should Do

• Warn users about ClickFix prompts, because the attack begins with a fake verification check that asks them to run a command.
• Block or monitor the vulnerable PDFWKRNL.sys driver, and check whether it is loading on endpoints despite the blocklist.
• Hunt for the scheduled task psychedelicloveUtils and the Registry Run key it uses.
• Check Chrome native-messaging hosts for unexpected entries, especially ones backed by PowerShell scripts.
• Monitor for HTTP traffic to 193.178.159[.]128 and the phishing domains listed above.
• Rotate credentials for browsers and cryptocurrency wallets if compromise is suspected.
• Treat any endpoint where security tools appear healthy but stop alerting as potentially blinded.

The Bottom Line

Psychedelic Stealer is part of the Lunex malware-as-a-service platform, and it spreads through compromised Ukrainian websites using fake Cloudflare checks, uses a vulnerable AMD driver to blind security tools, and leaves behind a Chrome-based backdoor that survives reboots, so if you see the psychedelicloveUtils task or the PDFWKRNL.sys driver loading unexpectedly, treat it as a serious incident and start hunting.

Quick Reference

What to Do

• Warn users about ClickFix
• Block or monitor PDFWKRNL.sys
• Hunt for psychedelicloveUtils
• Check Chrome native-messaging hosts
• Monitor C2 and phishing domains
• Rotate credentials if compromised
• Watch for blinded security tools

FAQ Section

What is Psychedelic Stealer?

It is the malware file that runs on victims' devices as part of the Lunex malware-as-a-service platform, and it steals browser credentials, cryptocurrency wallets, and other data.

How is it spreading?

Through the compromised of Ukrainian websites which incorporate an infected ClickFix iframe, which displays a fake Cloudflare verification prompt and tricks users into running a malicious command.

What is Lunex?

It is the underlying MaaS platform sold to multiple criminal groups, and Psychedelic is just one component of it.

What makes it unusual?

It uses a vulnerable AMD Radeon driver, PDFWKRNL.sys, for BYOVD defense evasion, which is rare for an information stealer, and it installs a Chrome native-messaging host backed by PowerShell that survives reboots.

How many panels exist?

Researchers identified 28 unique panels across 13 countries, up from six in June 2026.

What should I do if I suspect infection?

Check for the psychedelicloveUtils scheduled task, look for unexpected Chrome native-messaging hosts, monitor for traffic to 193.178.159[.]128, and rotate credentials.

Source: The Hacker News