Last Updated: 2026-09-24T22:49:33Z
What’s Happening
Lunex malware-as-a-service is being used by multiple criminal operators (28 panels across 13 countries, up from the original six panels identified by blueteamcoolteam in June). It uses a ClickFix lure on compromised sites to run an installer which loads a vulnerable driver to blind EDR and harvest credentials from browsers and exfiltrate crypto wallets before establishing three channels of persistence, surviving deletion.
The first campaign identified targeted Ukrainian users, while other campaigns have been found targeting western and middle eastern users.
Update:
- Rhys at Ontinue provides the first detailed analysis of Lunex.
- Arctic Wolf provides another analysis of the lure panel and goes into detail on the Ukrainian campaign.
Previously:
https://shitter.thepixora.com/RhysDowning\_/status/2102448863311171643
The loader transitions execution from user mode to kernel mode without triggering UAC, downloads ntkrnlmp.pdb from Microsoft’s symbol server, decrypts the AMD PDFWKRNL.sys driver vulnerable to CVE-2023-20598, and zeroes kernel callbacks associated with 20 security drivers across seven vendors. This blinds EDR products before the loader deploys what we are tracking as a new information-stealing malware family called Lunex, targeting the CIS region.
Final payload after BYOVD blinds EDR: psychedeliclove.exe, full C2 agent. 7 browsers, 6 wallets, Chrome/Edge NMH persistence via com.lunex.explorer. Triple persistence. Live C2 panel at time of analysis.
I have been unable to find any documented technical analysis of the binary. However, I discovered that @BlueTeamCoolTeamBlueTeamCoolTeam conducted OSINT research into the Lunex panels in June, which appears@BlueTeamCoolTeamBlueTeamCoolTeamto be related. I will be publishing a blog with a more detailed analysis soon.
Additionally found a public PoC for the PDFWKRNL.sys driver exploit. btcoolteam’s research into Lunex linked below as well.
IoCs
Both Artic Wolf and Ontinue have IoCs in their blog posts. Ontinue’s are linked here:
Actions
Focus on the stages before EDR blindness occurs:
- PDB downloads from non-development processes
- Driver drops to temporary directories
- Service creation for unsigned drivers from non-standard paths.
Post-EDR blindness, the Native Messaging Host registry key is the most reliable IoC
NativeMessagingHosts\com.lunex.explorer
