Back Securityaffairs.Co

OnyxC2 Malware-as-a-Service Offers Enterprise

Securityaffairs.Co •Pierluigi Paganini • June 11, 2026

OnyxC2 is a MaaS stealer targeting 210+ apps, using DLL sideloading, encrypted payloads, and remote access features to evade detection. OnyxC2 appeared on a cybercrime forum earlier this year and is sold as a subscription service: $250 per month for the standard build, $500 for the premium tier that includes HVNC, and $6,000 for an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OnyxC2 Stealer: Advanced Malware-as-a-Service Threatens Enterprise Security OnyxC2 Stealer has emerged as a significant Malware-as-a-Service (MaaS) threat, targeting over 210 applications for credential theft and remote access. Sold for as low as $250 per month, it employs sophisticated evasion techniques, including DLL sideloading and encrypted payloads, making detection difficult. The malware can harvest sensitive data from various platforms, including browsers, password managers, and cryptocurrency wallets. Its persistence allows continuous access across user sessions, raising concerns for organizations with complex third-party dependencies. The developers offer refunds if their builds are detected, indicating confidence in their evasion capabilities. The malware's modular architecture and web-based control panel facilitate use by less-skilled attackers, increasing the risk of widespread exploitation. As of now, OnyxC2 is actively being marketed on cybercrime forums, posing a growing threat to enterprise security. 7 sources 70

Extracted Entities

OnyxC2 Malware-as-a-Service Offers Enterprise

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)