Skip to navigation

Threat reportMalwareTL-2026-5337

Malicious Browser Extensions Ecosystem: Needle and Lunex Malware, Clean-Then-Update Extension Campaigns

mediumACTIVE

Intrinsec's CTI overview of the malicious browser extension ecosystem describes campaigns that publish clean extensions to build credibility and later push covert malicious updates, targeting cryptocurrency and authenticated sessions. Infrastructure analysis exposed C2 panels for the Needle and Lunex malware families, both of which deploy malicious browser extensions. First disclosed .

Key facts for Needle and Lunex stealers

IdentifiersTL-2026-5337, CVE-2023-20598
Also known asNeedle Stealer, Lunex Stealer, Psychedelic Stealer, LunarAxe, NaiveMess
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
EPSSCVE-2023-20598: 0.4% (37.3th percentile)
Affected productsGoogle Chrome (and Chromium-based browsers: Edge, Brave, Yandex Browser, Opera, Opera GX, Vivaldi); Microsoft Windows; AMD Radeon Software driver (PDFWKRNL.sys)
MalwareLunarAxe, Lunex, Needle, phantom
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1053.005 Scheduled Task/Job: Scheduled Task, T1055.012 Process Injection: Process Hollowing, T1059.001 Command and Scripting Interpreter: PowerShell, T1176 Software Extensions, T1185 Browser Session Hijacking, T1204.002 User Execution: Malicious File, T1539 Steal Web Session Cookie, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control, T1555.003 Credentials from Password Stores: Credentials from Web Browsers and 2 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, technology, consumer
Target regionsukraine, Global
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Needle and Lunex stealers

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5337 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Needle Stealer Loader Chain: iviewers.dll Side-Load and Argument-less RegAsm.exe Hollowing

Behaviour-first detection of the Needle (Golang infostealer MaaS) execution chain: the iviewers.dll DLL-hijacking loader and RegAsm.exe launched with no command-line arguments, the legitimate .NET utility hollowed to host Needle in memory. Source: Malwarebytes analysis of the malicious trading-website delivery chain.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1574.001, T1055.012, T1204.002
  • Data sources: sysmon (EventCode 1, EventCode 7), windows_security, defender_xdr_DeviceImageLoadEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 Image="*\\RegAsm.exe") OR (EventCode=7 ImageLoaded="*\\iviewers.dll"))
| eval signal=case(EventCode=7, "iviewers_dll_sideload_T1574.001", match(CommandLine, "(?i)regasm(\.exe)?\W*$"), "regasm_no_args_hollowing_T1055.012")
| where isnotnull(signal)
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(ParentImage) as parent_images values(ImageLoaded) as loaded_dll values(CommandLine) as command_lines by host, User, Image

Microsoft KQL

union
(
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "iviewers.dll"
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine, FileName, FolderPath, SHA256, Signal = "iviewers_dll_sideload_T1574.001"
),
(
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "RegAsm.exe"
    | where ProcessCommandLine matches regex @"(?i)regasm(\.exe)?\W*$"
    | project Timestamp, DeviceName, AccountName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine, FileName, FolderPath, SHA256, Signal = "regasm_no_args_hollowing_T1055.012"
)
| order by Timestamp desc

Sigma

title: Needle Stealer Loader iviewers.dll DLL Side-Loading
id: 5337a001-0001-4c3e-8a5b-0c0d1e2f3a01
status: experimental
description: Detects loading of iviewers.dll, the stage-1 DLL-hijacking loader used in the Needle stealer chain delivered from a malicious trading website.
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/04/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers
  - https://www.intrinsec.com/malicious-browser-extensions-ecosystem-overview/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: '\iviewers.dll'
  condition: selection
falsepositives:
  - Unlikely, a benign third-party image viewer shipping a library with this exact name
level: high
---
title: Needle Stealer RegAsm.exe Launched Without Arguments
id: 5337a001-0002-4c3e-8a5b-0c0d1e2f3a02
status: experimental
description: Detects RegAsm.exe started with no arguments, the process-hollowing host used to run Needle in memory.
references:
  - https://www.malwarebytes.com/blog/threat-intel/2026/04/malicious-trading-website-drop-malware-that-hands-over-your-browser-to-attackers
  - https://www.intrinsec.com/malicious-browser-extensions-ecosystem-overview/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.defense-evasion
  - attack.t1055.012
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\RegAsm.exe'
  selection_noargs:
    CommandLine|endswith:
      - 'RegAsm.exe'
      - 'RegAsm.exe"'
      - 'RegAsm.exe '
      - 'RegAsm.exe" '
      - 'RegAsm'
  condition: selection_img and selection_noargs
falsepositives:
  - Developer tooling or installers invoking RegAsm.exe with no arguments (rare)
level: high

Known false positives:

  • Developer or build tooling that launches RegAsm.exe with no arguments
  • Third-party software shipping a benign library named iviewers.dll

Tuning notes: Sysmon EventCode 7 must be enabled with image-load logging for non-system paths. Adjust index=sysmon to your Sysmon index. Exclude known build servers and Visual Studio parents (devenv.exe, msbuild.exe) from the RegAsm branch. Treat any iviewers.dll load outside a verified image-viewer install path as high priority.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ClickFix Fake-Verification PowerShell One-Liner Launched from Explorer · unlock with TL Creds
  • Browser Credential and Session Cookie Store Harvesting (Needle / Lunex Stealers) · unlock with TL Creds
  • Lunex MaaS C2 Panel and Community-Observed Sibling Infrastructure Connections · unlock with TL Creds
  • LunexLoader BYOVD ([indicator]) and CMSTPLUA UAC Bypass · unlock with TL Creds
  • Malicious Chromium Extension Persistence: Native Messaging Host and Forced Install Policy · unlock with TL Creds
  • DNS Resolution of Needle C2 and Lunex Phishing Infrastructure Domains · unlock with TL Creds
  • Lunex Psychedelic Stealer Persistence: psychedelicloveUtils Task and Run Key · unlock with TL Creds
  • Needle Stealer C2: Known C2 IPs and Hollowed RegAsm.exe Outbound Traffic · unlock with TL Creds

Indicators of compromise for Needle and Lunex stealers

As of 2026-11-05, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5337.

Sample indicators (3 of 26)

  • IP address: 178.16.55[.]234
  • Domain: coretest[.]digital
  • File hash: 95dcac62fc15e99d112d812f7687292e34de0e8e0a39e4f12082f726fa1b50ed

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

26 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for Needle and Lunex stealers

10 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Needle and Lunex stealers works

Intrinsec's CTI team (report TLP:CLEAR dated 2026-11-05, with an earlier March 2026 report shared with clients) reviews the malicious browser extension ecosystem. Described patterns include extensions that ship clean to gain trust and then receive silent, malicious updates, with theft of cryptocurrency and hijacking of authenticated sessions as primary goals. Intrinsec identified IP addresses exposing C2 panels for the Needle and Lunex malware families. For suspicious extensions found during an investigated incident, Intrinsec states no evidence of malicious activity was established at the time. The full PDF (IOCs, forum discussion) was not retrievable; technical detail below is taken from public reporting on the two named families.

Needle is a modular Golang infostealer / malware-as-a-service platform. Malwarebytes documents a chain delivered from a malicious trading website: a DLL-hijacking loader (iviewers.dll), a second-stage DLL, and process hollowing of Needle into RegAsm.exe, with a hidden ZIP (base.zip or meta.zip) unpacked by the 'ext' package. The browser extensions use Google-related names with popup.js, content.js and background.js and a cfg.json configuration giving full control of the browser: download interception, script injection, fake notifications and live browsing monitoring. Independent OTX-sourced analysis (2026-05-11) describes a browser-extension spoofer impersonating MetaMask, Phantom and Trust Wallet and a Rust desktop agent mimicking Exodus, Trezor and Ledger, with 1,932 victims (111 extension users, 1,821 desktop sessions), a C2 hosted on bulletproof ASN 202412 in Amsterdam, and an unencrypted API key embedded in the malware.

Lunex is a Russian-speaking MaaS platform first documented in June 2026 (six panels) and since grown to 28 panels across 13 countries. LunexLoader bypasses UAC via the CMSTPLUA COM object and uses BYOVD (the AMD driver PDFWKRNL.sys, CVE-2023-20598) to blind security processes. The Psychedelic Stealer payload was delivered via 100+ compromised Ukrainian websites using ClickFix-style fake Cloudflare verification (CERT-UA UAC-0277). It steals data from seven Chromium browsers and many crypto wallets, persists via Run key, hidden scheduled task 'psychedelicloveUtils' and a Chrome Native Messaging Host, and installs the LunarAxe extension (disguised as 'Microsoft Office Word Editor') paired with NaiveMess for filesystem access.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1185 Browser Session Hijacking

Defense Evasion

T1027 Obfuscated Files or Information; T1055.012 Process Injection: Process Hollowing; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1176 Software Extensions; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Privilege Escalation

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

defense-impairment

T1685 Disable or Modify Tools

Remediation for Needle and Lunex stealers

Patches

  • Update AMD Radeon Software to a version that fixes CVE-2023-20598

Immediate actions

  • Block the listed Needle and Lunex C2 domains and IPs at the perimeter and DNS layer
  • Inventory installed browser extensions across the fleet and remove unapproved ones, especially Google-named extensions and 'Microsoft Office Word Editor'
  • Hunt for iviewers.dll, RegAsm.exe spawned without arguments, base.zip/meta.zip, and the 'psychedelicloveUtils' scheduled task
  • Invalidate sessions and rotate credentials for users with suspicious extensions; move crypto assets from exposed wallets

Workarounds

  • Restrict PowerShell and Run-dialog execution for standard users
  • Disable Chrome Native Messaging hosts that are not on an approved list

Longer-term hardening

  • Enforce an extension allowlist via enterprise browser policy (ExtensionInstallAllowlist/Blocklist) and monitor extension updates and permission changes
  • Block the vulnerable PDFWKRNL.sys driver via the Microsoft vulnerable driver blocklist / WDAC
  • Train users to refuse ClickFix prompts that ask them to paste commands into Run or PowerShell

Affected and fixed versions

  • Google — Chrome (and Chromium-based browsers: Edge, Brave, Yandex Browser, Opera, Opera GX, Vivaldi)
    Vulnerable versions: Any version permitting installation of the malicious extensions
  • Microsoft — Windows
    Vulnerable versions: Windows endpoints running the loaders
  • AMD — Radeon Software driver (PDFWKRNL.sys)
    Vulnerable versions: Versions affected by CVE-2023-20598
    Fixed in: Vendor-patched Radeon Software release

Timeline of Needle and Lunex stealers

  • Intrinsec shares an earlier report on malicious browser extensions with clients (dated March 2026 per the source page; day not stated)
  • Malwarebytes publishes analysis of the locked-ioc-25 stealer delivered from a malicious trading website (April 2026; day not stated)
  • OTX-sourced analysis of a locked-ioc-25 C2 reports 1,932 victims and an exposed embedded API key
  • locked-ioc-26 MaaS platform first documented by BlueTeamCoolTeam with six active C2 panels (June 2026; day not stated)
  • ClickFix campaign using fake Cloudflare checks on 100+ compromised Ukrainian sites delivers locked-ioc-26 / Psychedelic Stealer (September 2026; tracked by CERT-UA as UAC-0277)
  • Arctic Wolf Labs documents a Psychedelic Stealer variant; locked-ioc-26 panel count reaches 28 across 13 countries
  • Intrinsec publishes the malicious browser extensions ecosystem overview, identifying IPs exposing locked-ioc-25 and locked-ioc-26 panels

Sources cited for Needle and Lunex stealers

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats