OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials

A commercial-grade information stealer called OnyxC2 has been marketed on cybercrime forums offering a web control panel, payload builder, and subscription pricing; it harvests browser-stored credentials, 2FA extensions, and crypto wallets, uses signed executable DLL sideloading and Cloudflare-fronted C2 communications to evade detection, and is distributed via password-protected archives and fake installers — the report includes technical analysis, mitigation guidance, and IOCs (domains, IPs, SHA-256 hashes, and C2 endpoint paths).