OnyxC2 Malware-as-a-Service Steals Credentials from 210 Applications

Key Takeaways

• OnyxC2 is a sophisticated new Malware-as-a-Service (MaaS) offering that targets over 210 applications and browser extensions to steal credentials.
• The malware is designed to be highly evasive, employing C++ with assembly code for system-level bypasses, polymorphic builds, DLL sideloading, and large, encrypted payloads to avoid detection.
• OnyxC2 is distributed via malicious fake software installers and archive files, lowering the technical barrier for threat actors to conduct widespread credential theft and remote access operations.
• Beyond credential theft, OnyxC2 includes a comprehensive remote-access toolkit, enabling keylogging, screenshots, file management, hidden browser sessions (HVNC), and anonymous traffic routing via a reverse SOCKS5 proxy and Tor tunnel.

New OnyxC2 Malware-as-a-Service Emerges, Targeting 210 Applications for Credential Theft

A formidable new credential-stealing tool, dubbed OnyxC2, has surfaced within the cybercrime underground, operating as a Malware-as-a-Service (MaaS). This sophisticated offering significantly lowers the barrier for entry into advanced cyber operations, enabling even less-skilled threat actors to execute widespread credential theft campaigns. OnyxC2 is capable of extracting sensitive login data from more than 210 different applications and browser extensions.

Marketed with the professionalism of legitimate commercial software, OnyxC2 offers a complete package for $250 per month. This subscription includes a web-based control panel, a payload builder, tiered pricing models, and even promises of refunds if a build is flagged by security systems. The malware provides buyers with all necessary components to discreetly exfiltrate login information from victims globally, distinguishing itself through the sheer breadth of its targeting capabilities.

Subscribers receive a comprehensive kit designed to pilfer browser credentials, password manager databases, two-factor authentication (2FA) codes, and cryptocurrency wallet details. The exfiltrated data is transmitted via an encrypted channel, complicating detection by security monitoring tools during transit.

Security researchers at Blackfog were instrumental in identifying this new threat. Their detailed report, shared with Cyber Security News (CSN), illuminates the full spectrum of OnyxC2’s capabilities and its advanced evasion techniques. The research team successfully obtained live builds of the malware, executed them within isolated sandbox environments, and confirmed active communication with command-and-control (C2) infrastructure.

OnyxC2 is developed in C++ and employs assembly code to bypass system-level security mechanisms. Each malware build undergoes mutation prior to distribution, a tactic designed to circumvent signature-based antivirus detection. The developer claims an impressive 99% evasion rate for these builds.

Blackfog’s independent testing corroborated these claims. Both sample builds submitted to VirusTotal initially registered as clean upon first upload. As of May 30, 2026, the malicious components within these samples remained largely undetected by most antivirus engines.

The potential for damage from OnyxC2 is substantial. Analysis of one infected machine’s dashboard revealed that it had already yielded 55 saved passwords, 4,717 cookies, 719 autofill entries, credit card information, and a cryptocurrency wallet—all from a single compromised host. Such extensive data hauls can provide attackers with immediate access to critical banking systems, corporate accounts, and various cloud services.

Extensive Targeting and Multifunctional Capabilities

The broad scope of applications targeted by OnyxC2 sets it apart from more rudimentary credential stealers. It specifically targets 37 Chromium-based browsers and 8 Gecko-based browsers, alongside 95 Chromium and 14 Gecko browser extensions. This includes six dedicated two-factor authentication tools, indicating that even accounts protected by 2FA are not immune to this threat.

The stealer also extends its reach to 5 popular password managers, 17 cryptocurrency wallets, 11 FTP clients, and 5 email clients. The ability to capture password manager data in conjunction with active session cookies allows attackers to maintain access to accounts even after victims reset their passwords. Furthermore, targeting FTP and email clients broadens the malware’s potential impact beyond personal accounts, enabling access to business systems frequently utilized by finance and operations teams.

Beyond its credential theft capabilities, OnyxC2 integrates a full remote-access toolkit. This allows operators to utilize Hidden Virtual Network Computing (HVNC) to control concealed browser sessions, deploy keyloggers, capture screenshots, and perform remote file management. The toolkit is further enhanced by a reverse SOCKS5 proxy and a built-in Tor tunnel, enabling attackers to route their traffic anonymously and maintain operational stealth.

Sophisticated Delivery and Evasion Tactics

OnyxC2 propagates through deceptive installer packages, which are disguised as legitimate software downloads. Researchers have identified lures mimicking applications such as Fling-Standalone, FinePrint, SystemSettings, and fake Windows update files. Each malicious archive is password-protected, a technique that helps it bypass automated scanning tools that require file extraction for inspection.

Inside these fake archives, victims encounter a two-file package engineered for DLL sideloading attacks. The first file is a legitimately signed application, inherently trusted by Windows. The second is a malicious DLL, deliberately named to impersonate a legitimate library that the signed program loads at startup. When the victim executes what appears to be a standard installer, the trusted application unwittingly loads and executes the attacker’s malicious code from the same directory.

The malicious DLL itself is deliberately inflated to over 120 MB, mimicking a genuine NVIDIA graphics library, complete with authentic-looking exported function names. This large file size often causes antivirus scanners to skip it to conserve processing time. The actual payload remains encrypted within this bloated DLL and is only decrypted and executed at runtime, further complicating detection.

What You Should Do

• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions with robust behavioral analysis capabilities to detect and block malicious activity that evades traditional signature-based antivirus.
• Enforce Anti-Data-Exfiltration Controls: Deploy endpoint security measures that focus on preventing unauthorized outbound data transfers, rather than solely relying on file scanning for malware detection.
• Educate Users on Phishing and Social Engineering: Conduct regular training for employees on how to identify and avoid suspicious downloads, fake installers, and phishing attempts.
• Exercise Caution with Downloads: Advise users to only download software from official vendor websites or trusted app stores, and to verify the authenticity of installers before running them.
• Enable Multi-Factor Authentication (MFA): While OnyxC2 targets 2FA codes, MFA still adds a crucial layer of security. Ensure strong MFA is enabled on all critical accounts, especially those that support hardware tokens or biometric verification.
• Regularly Back Up Data: Maintain regular, encrypted backups of critical data to mitigate the impact of successful data exfiltration or ransomware attacks.
• Monitor Network Traffic: Implement network monitoring to detect unusual outbound encrypted traffic or connections to suspicious C2 domains and IP addresses.

Indicators of Compromise:-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.