Lunex Unmasked: A New Information Stealer Deployed Through BYOVD

Reported 26 Sep 2026 by otx · Severity: medium

A sophisticated four-stage attack chain delivers the Lunex information stealer to Ukrainian-speaking users through fake CAPTCHA pages. The malware employs Bring Your Own Vulnerable Driver (BYOVD) techniques using AMD's PDFWKRNL.sys to disable kernel-level security monitoring befo