OnyxC2 Stealer Uses Cloudflare

Gbhackers •Mayura Kathir • June 12, 2026

A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product. For $250 a month buyers receive a web-based control panel, a payload builder, tiered licensing, and even refund guarantees if a build is detected lowering the barrier for […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OnyxC2 Stealer: Advanced Malware-as-a-Service Threatens Enterprise Security OnyxC2 Stealer has emerged as a significant Malware-as-a-Service (MaaS) threat, targeting over 210 applications for credential theft and remote access. Sold for as low as $250 per month, it employs sophisticated evasion techniques, including DLL sideloading and encrypted payloads, making detection difficult. The malware can harvest sensitive data from various platforms, including browsers, password managers, and cryptocurrency wallets. Its persistence allows continuous access across user sessions, raising concerns for organizations with complex third-party dependencies. The developers offer refunds if their builds are detected, indicating confidence in their evasion capabilities. The malware's modular architecture and web-based control panel facilitate use by less-skilled attackers, increasing the risk of widespread exploitation. As of now, OnyxC2 is actively being marketed on cybercrime forums, posing a growing threat to enterprise security. 7 sources 70

Extracted Entities

OnyxC2 Stealer Uses Cloudflare

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Malware (1)