Lunex Stealer Uses AMD Driver BYOVD to Disable EDR and Steal Browser Creds

Sun, 27 Sep 2026 15:38:27 +0000

Engineer — Learn: The BYOVD technique abusing a legitimate AMD driver to blind security tooling is worth noting for driver allowlist/blocklist hardening, but no KEV, PoC, or broad enterprise targeting signal means no immediate patching action is required.
SOC/IR — Plan: The four-stage chain—fake CAPTCHA ClickFix lure → PowerShell execution → vulnerable driver sideload → credential harvest—offers multiple detection opportunities; build or tune rules for ClickFix-style CAPTCHA-triggered script execution and for anomalous signed-driver loads that precede EDR tampering events.
Leader — Skip

Clickfix-Lure on CuraSec