Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

As cited

Copy frozen at 2026-09-27 01:41 UTC (site build).

threat intel

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

Lunex Stealer, distributed through compromised Ukrainian websites using fake CAPTCHAs and ClickFix-style Cloudflare verification checks, abuses AMD drivers to disable security monitoring and steal browser credentials. Security researchers from Ontinue identified the malware as part of a malware-as-a-service (MaaS) platform targeting Ukrainian-speaking users through a four-stage attack chain.

Why it matters: Organizations and users in Ukraine and Russian-speaking regions face credential theft and disabled endpoint protections; defenders should monitor for Lunex distribution patterns and validate driver loading controls.

Source published

2026-09-26 18:22 UTC

First seen by Cybersecurity Tracker

2026-09-27 00:28 UTC