Lunex MaaS & Psychedelic Stealer: AMD PDFWKRNL.sys BYOVD Blinds EDR

• 12023 — AMD discloses CVE-2023-20598, an improper-privilege-management flaw in the AMD Radeon graphics driver, fixed in Adrenalin 23.9.2 / Pro 23.Q4.
• 2March 2026 — The specific malicious PDFWKRNL.sys variant's hash is added to the LOLDrivers project.
• 3June 2026 — Earliest public references to Lunex; BlueTeamCoolTeam identifies six active C2 panels.
• 42026 — Arctic Wolf Labs documents the Psychedelic Stealer payload.
• 5September 26, 2026 — Ontinue publishes the full four-stage chain, links it to Lunex, and confirms the HVCI / Vulnerable Driver Blocklist gap.

Trusted Origin

The lure is served from real, compromised Ukrainian business sites — no typosquat domain to flag in the browser bar.

Clipboard Hand-off

The victim pastes the command themselves, so there is no automated download chain for a proxy to intercept.

MSI, Not PowerShell

msiexec execution sidesteps detections narrowly scoped to powershell.exe under a browser parent.

The pasted msiexec /i command pulls elita.msi from uasputnik[.]com and installs quietly under /passive. The MSI stages LunexLoader, the orchestration component responsible for privilege escalation, defence evasion and fetching the final payload.

LunexLoader elevates by abusing the CMSTPLUA auto-elevate COM object — a long-known UAC-bypass technique that lets a medium-integrity process obtain a high-integrity token without a consent prompt. Elevation is the prerequisite for the next step: loading a kernel-mode driver requires administrative rights.

With admin rights, LunexLoader drops and loads PDFWKRNL.sys, a legitimately signed AMD Radeon Software kernel driver that is vulnerable to CVE-2023-20598. Per NVD, that flaw (CVSS 3.1 base 7.8, HIGH; CWE-269 improper privilege management) lets a low-privileged user issue crafted IOCTLs to read and write arbitrary physical memory and I/O ports — an arbitrary kernel read/write primitive delivered by a Microsoft-trusted, signed binary.

What Lunex does with that primitive is the notable part. Instead of terminating security processes — which trips tamper-protection alarms and shows up as a missing service — the loader performs PDB-guided kernel callback zeroing. It resolves the offsets of EDR/AV notification callbacks (process-creation, image-load and similar kernel callback arrays) using symbol/PDB information, then writes zeros over those callback entries. The security agents keep running; they simply stop receiving the kernel telemetry they depend on. Ontinue characterises the result as leaving security products "running but blind."

With telemetry suppressed, the loader deploys psychedeliclove.exe (SHA-256 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90). This is the data-theft and C2 stage: it harvests browser credentials and wallets in one pass, then installs a persistent, browser-resident remote-access bridge. Command-and-control is plain HTTP to 193.178.159[.]128:8080, with a task-tracking file executed_tasks.json recording completed jobs.

• 1list_drives — enumerate drive letters C through Z.
• 2list_dir — list directory contents with file sizes.
• 3read_file — read arbitrary files in 512 KB chunks, up to 524 MB.
• 4write — write arbitrary data to any file path.
• 5download — pull files off the system.
• 6run — execute arbitrary programs; supported payloads include EXE, BAT, MSI and PowerShell.

The malicious browser extension is granted an aggressive permission set — cookies, history, bookmarks, tabs, storage, proxy, scripting, declarativeNetRequest, and all HTTP/HTTPS URLs — turning the browser into both a data source and a live control channel.

• 1Confirm delivery: check browser history and proxy logs for the fake-CAPTCHA site and any request to uasputnik[.]com/elita.msi.
• 2Check clipboard/Run MRU: inspect HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU for an msiexec /i http… entry.
• 3Hunt the driver: look for a PDFWKRNL.sys load event (Sysmon EID 6) from a non-standard path, especially on hosts with no AMD GPU.
• 4Enumerate persistence: the scheduled task psychedelicloveUtils and the Run key; export both before remediation.
• 5Inspect the browser: look for a Native Messaging Host manifest named com.lunex.explorer and an extension with the aggressive permission set.
• 6Pull network records: off-host firewall/NetFlow for HTTP to 193.178.159[.]128:8080.
• 7Hash-match: scan for psychedeliclove.exe by SHA-256 and locate executed_tasks.json.
• 8Assume EDR blindness: validate agent callback health; if the host was compromised, treat local EDR telemetry from the window after driver load as unreliable.

Do not rely on HVCI or the default Microsoft Vulnerable Driver Blocklist for this variant — Ontinue confirmed both miss it. Deploy an explicit WDAC deny rule for the PDFWKRNL.sys hash and, where feasible, block by the driver's signing attributes. Pull the current hash from LOLDrivers into your policy.

• 1Disable the Win+R Run box for standard users via GPO (User Configuration → Administrative Templates → Start Menu and Taskbar → Remove Run menu) where the workflow allows.
• 2Alert on msiexec.exe installing an MSI from an http(s) URL — a rare, high-signal event in most fleets.
• 3Restrict remote MSI installs via AppLocker / WDAC and block outbound to unknown MSI-hosting domains at the proxy.

• 1Set UAC to always prompt (ConsentPromptBehaviorAdmin = 2) to raise the cost of CMSTPLUA-style auto-elevation.
• 2Enforce an enterprise browser extension allowlist (ExtensionInstallAllowlist) and audit Native Messaging Host manifests as persistence.
• 3Block the IOCs in Phase 08 at proxy/firewall/DNS; add the SHA-256 to EDR custom indicators.
• 4For confirmed hosts, reset all browser-stored credentials and rotate any crypto wallet seeds handled on the machine — assume exfiltration.