OnyxC2

OnyxC2 is a malware-as-a-service (MaaS) infostealer that emerged on cybercrime forums in early 2026 and is marketed as a low-cost, enterprise-grade credential theft and remote access platform. It is sold in subscription tiers, including a standard build for $250 per month, a premium build for $500 per month that includes HVNC, and source code offered for $6,000. The service includes a web-based control panel and builder, with panel sections such as bots, logs, builder, users, and settings, as well as support, cloud storage, AES-256-encrypted build downloads, and refund promises if a build is detected.

Based on the provided reporting, OnyxC2 targets more than 210 applications across multiple categories, including 37 Chromium-based browsers, 8 Gecko-based browsers, 95 Chromium browser extensions, 14 Gecko browser extensions including 6 dedicated two-factor authentication extensions, 5 password managers, 17 cryptocurrency wallets, 11 FTP clients, and 5 email clients. Additional reporting states it also targets VPN, remote access, messaging, note-taking, and gaming applications. It is designed to steal saved passwords, cookies, autofill data, payment card data, cryptocurrency wallet information, and active session cookies, enabling session hijacking even after password changes.

OnyxC2 also includes broader post-compromise and remote access functionality. Reported capabilities include HVNC, keylogging, screenshot capture, file management, reverse SOCKS5 proxying, Tor tunneling, reverse shell over HTTP, LSASS memory dumping, and RunPE execution in memory and on disk.

The malware uses multiple evasion and delivery techniques. Researchers reported DLL sideloading using legitimate signed applications bundled with malicious DLLs inside fake installer packages and password-protected archives. Observed lure installers impersonated FinePrint, SystemSettings, fake Windows update packages, and Fling-Standalone. The malicious DLL was described as padded beyond 120-130 MB, disguised as an NVIDIA graphics library with realistic export names, and containing an encrypted payload that decrypts only at runtime. Reporting also states that parts of execution occur in memory, builds are mutated before delivery, and one signed host executable scored 0/71 detections on VirusTotal. BlackFog reported both analyzed delivery archives were initially clean on VirusTotal, and the malicious component remained unflagged as of May 30, 2026.

BlackFog researchers obtained and analyzed two samples, executed live builds in sandbox environments, and confirmed communication with live command-and-control infrastructure. In one observed infection shown in the operator panel, a single compromised host yielded 55 saved passwords, 4,717 cookies, 719 autofill entries, 2 payment cards, and 1 cryptocurrency wallet.

High-confidence indicators mentioned in the content include the domain akmuniverstall.top, the default C2 endpoint path /backend/api/app.php, and Cloudflare-fronted IP addresses 104.18.20.213, 104.21.46.39, and 172.67.223.39.