Lunex malware uses vulnerable AMD driver to blind security tools

Security researchers at Ontinue traced a credential-stealing campaign aimed at Ukrainian-speaking users to Lunex, a malware platform sold to criminal groups. Its loader uses a vulnerable AMD Radeon driver to gain elevated access and blind security tools while their processes keep running. The stealer then takes browser passwords, session cookies and cryptocurrency wallet data, and installs a component that preserves remote access through the browser. Ontinue identified 28 Lunex control panels across 13 countries, compared with six identified in June. In tests, neither Windows memory integrity protection nor Microsoft's current vulnerable-driver blocklist stopped the driver variant used in this attack chain from loading.