OnyxC2 Malware-as-a-Service Offers Enterprise-Grade Data Theft

OnyxC2 is a commercially sold malware-as-a-service infostealer that targets 210+ applications—including browsers, password managers, 2FA extensions, cryptocurrency wallets, FTP and email clients—and bundles remote-access features (HVNC, LSASS dumping, RunPE, keylogger, reverse SOCKS5) and persistence mechanisms. The developers use DLL sideloading with a valid Authenticode-signed installer and encrypted runtime payloads to evade detection, ship pre-built lure installers, and market the product on cybercrime forums with subscription and source-code pricing; BlackFog observed live panels and low VirusTotal detections, indicating active criminal use and high operational risk.