Lunex Unmasked: A New Information Stealer Deployed Through BYOVD

Lunex is a sophisticated information stealer malware targeting Ukrainian-speaking users via fake CAPTCHA pages. It uses a four-stage attack chain and employs Bring Your Own Vulnerable Driver (BYOVD) techniques with AMD's PDFWKRNL.sys to disable kernel-level security monitoring. The malware targets seven Chromium-based browsers to extract credentials and cryptocurrency wallets, maintaining persistence through PowerShell-based Chrome Native Messaging Hosts. It operates a large command-and-control infrastructure across multiple countries and is run by a financially motivated threat actor from the CIS region as a Malware-as-a-Service platform.

• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• PureRAT and PureLogs Campaign Targeting Japanese OrganizationsCampaign2026-09-25
• The Stealer Factory: Unpacking a Python-Based MaaS Infostealer BuilderCampaign2026-09-28
• Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMMMalware2026-09-17
• REVSTEALER ramps up: analysis of up-and-coming infostealerMalware2026-09-06