Lunex Stealer blinds EDR with an AMD driver, then takes Chrome

Your endpoint agent can show a green check while seeing nothing. That is the point of the Lunex Stealer chain that Ontinue's Cyber Defence Centre reverse-engineered: it loads a signed-but-vulnerable AMD driver, zeroes the kernel callbacks that security tools register, and leaves those tools running and reporting healthy. Then it walks off with every password Chrome saved.

What actually happened

Per Ontinue's research as reported by The Hacker News:

• The entry point is a fake CAPTCHA. Compromised websites serve a "verify you are human" page that starts a four-stage chain ending in a full command-and-control agent. The campaign targets Ukrainian-speaking users, and panel analysis points to a Russian-speaking developer.
• The driver is PDFWKRNL.sys, a kernel-mode AMD Radeon Software component vulnerable to CVE-2023-20598. This is classic BYOVD — bring your own vulnerable driver. The file is legitimately signed, so it loads.
• It blinds rather than kills. Instead of terminating security processes, the chain uses PDB-guided kernel callback zeroing. Your EDR keeps running. It just stops getting told anything.
• The blocklists do not cover this variant. Neither Microsoft's Vulnerable Driver Blocklist nor HVCI currently stops this PDFWKRNL.sys build from loading, even though the CVE has been in LOLDrivers since March 2026.
• Then it collects. Credentials from seven Chromium browsers — Chrome, Edge, Brave, Yandex, Opera, Opera GX and Vivaldi — plus five desktop crypto wallets and four wallet extensions. It installs a PowerShell-based Chrome Native Messaging Host for persistent remote filesystem access.
• This is a platform, not one crew. Ontinue counted 28 unique Lunex panels across 13 countries, up from six in June 2026. It is being sold.

Why a blinded EDR matters for your business

Most small companies buy one security product and treat the dashboard as ground truth. This chain is built specifically to make that dashboard lie — not by disabling the agent, which would page someone, but by cutting the wire behind it.

So stop treating "no alerts" as evidence. The signal you want is absence of signal where you expect it: a workstation that stopped sending telemetry, or sent noticeably less of it, while staying online. That check lives in your log pipeline, not in your endpoint console.

The concrete fixes are unglamorous. Turn on the Microsoft Vulnerable Driver Blocklist and add PDFWKRNL.sys by hash yourself, because the default list does not have this one. Block driver installation by standard users — BYOVD needs a privileged load, and most staff accounts should not be able to give it one. And get saved passwords out of browser profiles: a password manager with a real vault means a stealer's harvest is one encrypted blob instead of a working credential list. Same for the browser-based crypto wallets, if anyone on your team runs one on a work machine.

Sources: The Hacker News: Lunex Stealer Abuses AMD Driver to Disable Security Monitoring, Security Magazine.