Reported by 8 outlets

Psychedelic Stealer spread via fake CAPTCHA prompts on Ukrainian company sites

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 8 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 1.70 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.22 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

all-about-security.deamd.comnvd.nist.govthehackernews.comgithub.comblueteam.coolcyberworldops.eusekurak.pl CVE-2023-20598 desk first seen 19d ago

Desk analysis

Lunex is the malware-as-a-service platform and Psychedelic is the name of its stealer binary, named for the embedded "Psychedelic" configuration tag. In the September campaign, compromised Ukrainian business sites serve injected iframes that load a fake Cloudflare verification page; interacting with it copies an msiexec command to the clipboard for a Windows Run paste, fetching elita.msi from uasputnik[.]com, a domain registered September 9, 2026. The MSI pulls psychedeliclove.exe from 107.175.82[.]242:9000, and the loader chain bypasses UAC through the CMSTPLUA COM object before loading the AMD Radeon kernel driver pdfwkrnl.sys as a BYOVD step under CVE-2023-20598, zeroing kernel callbacks so that security tools keep running but stop seeing the host. The stealer reports to 193.178.159[.]128:8080 over API paths including /api/v1/ext/passwords, /api/v1/ext/tokens, and /api/v1/ext/wallets, and accepts operator tasking for EXE, COM, BAT, CMD, MSI, and PowerShell payloads.

The September events frame a new campaign, but the platform behind it is older, larger, and already public. The AMD advisory AMD-SB-6009 for CVE-2023-20598 was published October 16, 2023, and a working public exploit for pdfwkrnl.sys has sat on GitHub since December 22, 2025. BlueTeamCoolTeam documented a ClickFix/CAPTCHA chain delivering Lunex on June 10, 2026 and found six live panels across five countries by June 12, with the first panel stood up May 14, 2026; by late September Ontinue counted 28 panels across 13 countries. The unspoken implication is that this is not a Ukrainian-sites problem but a platform-growth problem: any affiliate running any ClickFix lure can bolt on the same BYOVD step, and the panel feature set extends past credential theft into live financial fraud, with inject, spoof, screenshot, and remote browser control, plus a PowerShell-based native messaging host, com.lunex.explorer, that survives stealer deletion, reboots, and browser restarts. Ontinue's validated testing found neither HVCI nor Microsoft's Vulnerable Driver Blocklist blocks the specific pdfwkrnl.sys variant, despite the hash sitting in the LOLDrivers catalogue since March 2026.

Patch Radeon Software to Adrenalin 23.9.2 (23.20.11.01) or later, and PRO Edition deployments to 23.Q4 (23.30.13.03) or later, including Ryzen 6000 and 7000-series machines with integrated Radeon graphics per AMD-SB-6009. Since the stock blocklist fails for this variant, add explicit driver-block rules for pdfwkrnl.sys outside managed AMD installs and alert on unexpected loads. Hunt on PowerShell Script Block Logging Event ID 4104 for msiexec commands carrying https URLs or the ORG_NOTE property, on msiexec.exe spawned from the Run dialog with a remote URL, and on CMSTPLUA COM object use as a UAC bypass. Persistence and staging names to sweep for: scheduled task psychedelicloveUtils, com.lunex.explorer.json with host.ps1 and host.bat in browser profiles, wd_tmp.db, and executed_tasks.json. Block and alert on uasputnik[.]com, fsputnik[.]com/tds/tracker.js, 193.178.159[.]128:8080, 107.175.82[.]242:9000, and the /api/v1/ext/ and /api/v1/agent/ request paths. Anyone who completed a lure gave up saved passwords and session cookies, so force credential resets and session revocation with step-up authentication, and review browser extensions against managed baselines.

Two developments would move this assessment. First, audience shift: the fake-CAPTCHA lures are currently Ukrainian-language and the panel counts 446 of 557 views from Ukraine, so English or other regional variants, or panel growth beyond the 28 counted in September, would mean affiliate reuse has gone wide and exposure stops being regional. Second, vendor response on the driver: a Microsoft blocklist update or AMD driver revocation that actually stops this pdfwkrnl.sys variant would cut the BYOVD leg out of the chain, while other stealers copying the callback-zeroing approach would raise the same technique from one family to a standard mover.

Timeline

original reporting

Psychedelic Stealer: fake CAPTCHAs on Ukrainian company sites distribute infostealer

www.all-about-security.de · 19d ago · September 24th, 2026

Psychedelic Stealer: fake CAPTCHAs on Ukrainian company sites distribute an infostealer. Anyone who follows the prompt launches, via the W

via Mastodon https://www.all-about-security.de/psychedelic-stealer-gefaelschte-captchas-auf-ukrainischen-firmenseiten-verbreiten-infostealer/
update from amd.com

AMD security bulletin AMD-SB-6009: Radeon Graphics kernel driver privilege management vulnerability (CVE-2023-20598)

amd.com · 1094d ago · October 16th, 2023

AMD's vendor advisory, initial publication 2023-10-16 per its Revisions table, describes CVE-2023-20598 in the Radeon Software kernel driver pdfwkrnl.sys: improper privilege management lets an authenticated attacker craft an IOCTL to gain I/O control over arbitrary hardware ports or physical addresses, potentially yielding arbitrary code execution. It credits Takahiro Haruyama of VMware with the report and sets fixes at Adrenalin Edition 23.9.2 (23.20.11.01, 2023-09-19) and PRO Edition 23.Q4 (23.30.13.03), covering Radeon RX 5000/6000/7000 cards and Ryzen 6000/7000-series processors with Radeon graphics.
update from nvd.nist.gov

NVD record for CVE-2023-20598

nvd.nist.gov · 1093d ago · October 17th, 2023

Affected configurations list Radeon Software Adrenalin up to (excluding) 23.9.2 and PRO up to (excluding) 23.Q4 across RX 5000/6000/7000, Radeon PRO W5000-W7000, and Ryzen 6000/7000-series iGPU platforms; the linked vendor advisory is AMD-SB-6009.
update from thehackernews.com

The Hacker News: researchers catalogue 34 vulnerable Windows drivers including PDFWKRNL.sys (CVE-2023-20598)

thehackernews.com · 1076d ago · November 2nd, 2023

This November 2023 article covers VMware Carbon Black researcher Takahiro Haruyama's study of 34 Windows drivers with firmware access through port I/O and memory-mapped I/O, explicitly naming PDFWKRNL.sys (CVE-2023-20598) among them. It notes six of the drivers allow kernel memory access that can be abused to elevate privilege and defeat security solutions, foreshadowing the exact BYOVD use Lunex applies to the driver.
update from github.com

Public pdfwkrnl.sys exploit repository for CVE-2023-20598

github.com · 295d ago · December 22nd, 2025

The GitHub repository unkvolism/pdfwkrnl, described as 'pdfwkrnl.sys exploit', was created on 2025-12-22T23:06:42Z, nine months before the September 2026 campaign. The Hacker News' September 26, 2026 Lunex report links this repository as the privilege-escalation code path for CVE-2023-20598, meaning public, working exploit code for the AMD driver predates the observed abuse by roughly nine months.
update from blueteam.cool

BlueTeamCoolTeam: original ClickFix/CAPTCHA campaign analysis dropping the Lunex Rust stealer

blueteam.cool · 126d ago · June 10th, 2026

Luke Wilkinson's June 10, 2026 post documented the ClickFix/CAPTCHA campaign three months before the story's September window: the lure page at captcha-code[.]lol delivered a five-layer RC4-plus-gzip PowerShell loader that dropped the Lunex infostealer, a Rust binary that force-installed a malicious browser extension, enumerated active Windows logon sessions via LSA APIs, and performed Active Directory user and group reconnaissance. The C2 in that sample was 94.154.32[.]21:8080.
update from blueteam.cool

BlueTeamCoolTeam: OSINT into a live Lunex stealer C2 panel network

blueteam.cool · 124d ago · June 12th, 2026

Posted June 12, 2026 and updated June 14, this Shodan-and-Validin investigation confirmed six live Lunex C2 panels on port 8000 across the US, Finland, Germany, the Netherlands, and Ukraine, with the first panel deployed 2026-05-14, plus a Cloudflare-hidden panel at api-goo-drivehosting[.]com registered 2026-06-05 to imitate Google API traffic. It published the Lunex favicon MD5 b9251db3aa9511157cba432c0b5402fc for infrastructure hunting and showed the panel supports JavaScript injection, content spoofing, screenshots, and full remote browser control, not just credential collection.
update from thehackernews.com

The Hacker News: hacked Ukrainian sites serve fake Cloudflare ClickFix lures for Psychedelic Stealer (Arctic Wolf Labs report)

thehackernews.com · 19d ago · September 24th, 2026

Published 2026-09-24T19:59:00+05:30 (14:29 UTC, 36 minutes before the story's first_seen), this was the first coverage of the September campaign, summarizing Arctic Wolf Labs' technical report: compromised Ukrainian business sites injected iframes loading fsputnik[.]com/tds/tracker.js, the fake Cloudflare CAPTCHA copied an msiexec command fetching elita.msi from uasputnik[.]com (registered September 9, 2026), and the payload psychedeliclove.exe reported to C2 193.178.159[.]128:8080. The exposed Rublevka TDS lure panel recorded 557 views, 426 clicks, and 79 complete events across 32 countries, 446 of the views from Ukraine.
update from cyberworldops.eu

Ontinue reports Lunex stealer using a vulnerable AMD driver to evade controls in a four-stage ClickFix chain targeting Ukrainian-speaking us

cyberworldops.eu · 17d ago · September 26th, 2026

Ontinue reports Lunex stealer using a vulnerable AMD driver to evade controls in a four-stage ClickFix chain targeting Ukrainian-speaking us

via Mastodon https://cyberworldops.eu/en/lunex-turns-a-flawed-amd-driver-into-a-stealth-layer-for-browser-and
update from thehackernews.com

🤖 Lunex Stealer (aka Psychedelic Stealer) MaaS: ClickFix fake CAPTCHA on compromised Ukrainian sites -> UAC bypass via CMSTPLUA COM object -

thehackernews.com · 17d ago · September 26th, 2026

🤖 Lunex Stealer (aka Psychedelic Stealer) MaaS: ClickFix fake CAPTCHA on compromised Ukrainian sites -> UAC bypass via CMSTPLUA COM object -

via Mastodon https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
update from sekurak.pl

Cybercriminals serve malware on hacked sites: details of the Psychedelic Stealer campaign (Arctic Wolf Labs)

sekurak.pl · 15d ago · September 29th, 2026

Cybercriminals serve malware on hacked websites. Details of the Psychedelic Stealer campaign: Arctic Wolf Labs security researchers report [content truncated in original snippet]. via Mastodon https://sekurak.pl/cyberprzestepcy-serwuja-malware-na-zhakowanych-stronach-szczegoly-kampanii-psychedelic-stealer/

Covered in

digest 2026-09-27