The Psychedelic Stealer Malware Unveiled as Part of Lunex Malware-as-a-Service Platform
The Psychedelic Stealer malware, which is being distributed through compromised Ukrainian websites with ClickFix-style Cloudflare verification checks, has been identified as a component of the larger malware-as-a-service (MaaS) platform known as Lunex.
Ontinue, a cybersecurity firm, has revealed that the Psychedelic Stealer operates as part of a four-stage attack chain specifically targeting Ukrainian-speaking users.
In a technical report, Ontinue’s threat researcher, Rhys Downing, explained, “The attack chain commences with a deceptive CAPTCHA page and concludes with the deployment of a comprehensive C2 agent. The stealer is capable of extracting credentials and data from seven Chromium-based browsers, extracting cryptocurrency wallets, and establishing persistent remote filesystem access through a PowerShell-based Native Messaging Host integrated into the victim’s browser.”
The infection process involves the use of fraudulent MSI installers delivered via ClickFix, triggering a series of actions that include delivering a loader named LunexLoader. This loader is designed to bypass User Account Control (UAC) on Windows by utilizing the CMSTPLUA COM object. It also leverages the bring your own vulnerable driver (BYOVD) technique for defense evasion before downloading the stealer payload.
The utilization of the BYOVD technique is particularly noteworthy, as it is not commonly employed as a precursor to deploying a final-stage payload like an information stealer. Lunex exploits a vulnerable kernel-mode driver for AMD Radeon Software (PDFWKRNL.sys) to escalate privileges and blind security-related processes while ensuring their continuous operation.
Arctic Wolf Labs initially documented the Psychedelic Stealer earlier this week, outlining the threat actor’s strategy of compromising legitimate websites such as a hair-treatment clinic, a scale-model manufacturer, a specialist bookseller, a psychological facility, a tool retailer, and an automotive retailer to inject an iframe element serving the ClickFix lure.
According to Downing, “Before the stealer is deployed, the malware is programmed to utilize a legitimate yet vulnerable driver to disable security tools on the victim’s machine. Subsequently, with these protections disabled, the information stealer is unleashed to harvest browser passwords, session cookies, and cryptocurrency wallet data.”
The Lunex platform was first referenced in cybersecurity literature in June 2026, with BlueTeamCoolTeam’s Luke Wilkinson identifying six active Lunex Stealer’s command-and-control (C2) panels across various countries.
It should be noted that Psychedelic Stealer and LunexStealer refer to the same element of the MaaS platform. While ‘Psychedelic’ denotes the malware file running on victims’ devices, ‘Lunex’ represents the underlying platform marketed to multiple criminal groups.
Upon execution, LunexStealer communicates with the Lunex panel to execute various information theft operations, including stealing credentials from multiple browsers, enumerating cryptocurrency wallets, and establishing persistence using a Registry Run key and a hidden scheduled task named “psychedelicloveUtils.”
Analysis of the Lunex panel indicates the involvement of a Russian-speaking developer or team, with multiple panels detected across different countries, highlighting a significant expansion since June 2026.
One of the panels located in Turkey has been linked to five phishing domains, suggesting that the MaaS platform extends beyond credential theft to include brand impersonation and phishing activities.
According to Ontinue, the BYOVD delivery chain represents a stealthier approach to EDR neutralization, leaving security products operational but blind. Despite efforts to prevent the specific PDFWKRNL.sys variant from loading, certain gaps persist, as demonstrated by validated testing.
