Hackers Use OnyxC2 Malware-as-a

Cybersecuritynews •Tushar Subhra Dutta • June 12, 2026

A new and dangerous credential-stealing tool called OnyxC2 has emerged in the cybercrime underground, showing just how easy it has become for even low-skilled attackers to run a professional hacking operation. Sold as a complete package for $250 a month, the malware gives buyers everything they need to quietly drain login data from victims worldwide. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OnyxC2 Stealer: Advanced Malware-as-a-Service Threatens Enterprise Security OnyxC2 Stealer has emerged as a significant Malware-as-a-Service (MaaS) threat, targeting over 210 applications for credential theft and remote access. Sold for as low as $250 per month, it employs sophisticated evasion techniques, including DLL sideloading and encrypted payloads, making detection difficult. The malware can harvest sensitive data from various platforms, including browsers, password managers, and cryptocurrency wallets. Its persistence allows continuous access across user sessions, raising concerns for organizations with complex third-party dependencies. The developers offer refunds if their builds are detected, indicating confidence in their evasion capabilities. The malware's modular architecture and web-based control panel facilitate use by less-skilled attackers, increasing the risk of widespread exploitation. As of now, OnyxC2 is actively being marketed on cybercrime forums, posing a growing threat to enterprise security. 7 sources 70

Extracted Entities

Hackers Use OnyxC2 Malware-as-a

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)