Plan
archived
Lunex Stealer Uses AMD Driver BYOVD to Disable EDR and Steal Browser Creds
- Engineer — Learn: The BYOVD technique abusing a legitimate AMD driver to blind security tooling is worth noting for driver allowlist/blocklist hardening, but no KEV, PoC, or broad enterprise targeting signal means no immediate patching action is required.
- SOC/IR — Plan: The four-stage chain—fake CAPTCHA ClickFix lure → PowerShell execution → vulnerable driver sideload → credential harvest—offers multiple detection opportunities; build or tune rules for ClickFix-style CAPTCHA-triggered script execution and for anomalous signed-driver loads that precede EDR tampering events.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.