‘Lunex’ malware uses AMD driver flaw to disable defenses and steal credentials
Researchers say the Lunex information‑stealing tool abuses a vulnerable AMD driver to turn off key security monitoring in Windows before collecting browser credentials and cryptocurrency wallet data.
A newly documented malware strain is using a trusted hardware driver as its shield, cutting off parts of Windows’ visibility before harvesting whatever credentials it can find.
Security researchers describe “Lunex” as an information‑stealing tool built around a Bring‑Your‑Own‑Vulnerable‑Driver (BYOVD) technique. The attackers load a legitimate but flawed AMD driver and then exploit its access in the Windows kernel to clear callbacks that security products use to monitor system activity.
Once those callbacks are removed, security tools that depend on them see less of what the operating system is doing. In that blind spot, Lunex focuses on stealing browser‑stored credentials and data linked to cryptocurrency wallets.
For individual users, that puts saved logins for email, banking, social media and other services at risk. For organizations, it creates a path into corporate dashboards, repositories or administration consoles when staff rely on in‑browser password storage. Holders of digital assets face the risk that wallets tied to compromised keys could be emptied quickly and with little chance of recovery.
The case underlines how attackers are shifting from trying to dodge detection at the application level to undermining the mechanisms that provide detection in the first place. By abusing a signed driver that Windows trusts, Lunex code reaches a privileged layer from which it can interfere with the tools meant to stop it.
Driver vulnerabilities remain attractive because old, vulnerable versions often stay available even after patches are released. Malware authors can package these drivers into their own toolkits, rely on the operating system to accept them as legitimate and then trigger the same flaw that defenders thought they had left behind.
For security teams, Lunex is a reminder that protection has to extend into the kernel. Measures such as driver blocklists, careful control of which drivers can load and close monitoring for unexpected driver activity are becoming as important as traditional antivirus signatures.
Practical signs to watch include whether AMD and Microsoft expand their driver blocklists in response, whether similar BYOVD chains appear in other malware families, and whether there is a noticeable rise in credential theft and unexplained cryptocurrency losses linked to this technique.
Sources
- OSINT