FlagThis — Daily Cybersecurity Intelligence Briefing

Attackers are exploiting a vulnerability in a Microsoft-signed kernel driver, example_driver.sys, which facilitates arbitrary kernel memory read/write operations through IOCTL 0x80002000. By leveraging this trusted signature, threat actors bypass endpoint protection by unhooking security callbacks and subverting PatchGuard. This "Bring Your Own Vulnerable Driver" (BYOVD) technique enables unauthorized privilege escalation and the theft of sensitive credentials from LSASS, SAM, and domain controllers via DCsync. This method presents a critical risk by subverting the root of trust in the Windows kernel to evade detection and facilitate widespread lateral movement across high-value environments.

The Lunex Malware-as-a-Service (MaaS) platform is deploying the Psychedelic Stealer by exploiting CVE-2025-54517 in the legitimate AMD driver amdhdl64.sys. This campaign utilizes a Bring Your Own Vulnerable Driver (BYOVD) technique to achieve unsigned kernel-mode code execution, allowing attackers to disable EDR sensors within approximately two minutes of infection. Following defense neutralization, the stealer harvests browser credentials, session cookies, and autofill data from Chrome, Edge, and Firefox. Targeting Ukrainian-speaking users via fake CAPTCHA/ClickFix social engineering prompts, the campaign has impacted approximately 12,000 endpoints, resulting in significant credential theft and an estimated $3.2M in financial losses.