OnyxC2 is a new malware-as-a-service information stealer distributed via DLL sideloading within signed applications, with its payload encrypted until runtime for evasion. It targets credentials from over 210 applications and includes features like LSASS memory dumping and a reverse SOCKS5 proxy for persistent access. The MaaS model, sold for $250/month, significantly lowers the barrier to entry for threat actors.
Malware OnyxC2 stealer sold as a service targets over 210 applications June 11, 2026 Share By SC Staff As reported by Security Affairs, OnyxC2 has emerged as a new malware-as-a-service (MaaS) stealer, aggressively targeting a wide array of applications and employing sophisticated evasion techniques to avoid detection. OnyxC2 is being sold on cybercrime forums for as little as $250 per month, with developers offering refunds if their builds are detected, highlighting confidence in its evasion capabilities. BlackFog researchers have identified that OnyxC2 targets over 210 applications, including numerous browsers, extensions, password managers, cryptocurrency wallets, FTP clients, and email clients. The stealer's capabilities extend beyond credential harvesting, incorporating features like High-Volume Network Interface (HVNC), LSASS memory dumping, and a reverse SOCKS5 proxy. Delivery is achieved through DLL sideloading, where a malicious DLL is appended to legitimate content within a signed application, making it appear valid. The payload remains encrypted until runtime, further hindering detection. The package also includes pre-made lure installers to aid in distribution. The MaaS model lowers the barrier to entry for malicious actors, providing a complete operational kit with evasion, panel access, and support, turning a single infection into persistent access across a user's digital life. Source: Security Affairs SC Staff Related Malware Malicious podcast, PDF apps spread FlutterShell macOS backdoor malware Laura French June 5, 2026 FlutterShell is linked to previous malvertising campaigns including TamperedChef. Malware New malspam campaign uses Google DoubleClick to deliver DesckVB RAT SC Staff June 4, 2026 The campaign begins with a phishing email containing an HTML attachment. Malware WeedHack malware campaign targets over 116,000 Minecraft players SC Staff June 3, 2026 The WeedHack malware is distributed through malicious Minecraft-related mods, clients, and utilities promoted via YouTube and search engine poisoning. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds