OnyxC2 Stealer Sells Extensive Credential Theft Capabilities for $250 a Month
Summary
OnyxC2 is offered as a stealer-as-a-service from $250 per month. BlackFog analyzed samples and described its credential-theft capabilities and a delivery method using a signed app paired with a disguised malicious DLL.
Key points
- OnyxC2 is offered through a MaaS model, with a standard plan at $250 per month and a premium plan at $500 per month, according to the article.
- The developers claim the stealer targets browsers, extensions, password managers, wallets, and other software—roughly 210 applications and extensions across nine categories, BlackFog says.
- BlackFog says one panel it examined showed 55 saved passwords, 4,717 cookies, 719 autofill entries, two cards, and a cryptocurrency wallet from one host.
- The tool is bundled with remote-access features including HVNC, LSASS dumping, RunPE, a reverse SOCKS5 proxy, keylogging, and a reverse shell over HTTP.
- BlackFog found a signed legitimate application paired with a malicious DLL disguised as an NVIDIA graphics library; running the application loads the DLL, and the payload remains encrypted until runtime.
- BlackFog reported that the delivery archives initially had no VirusTotal detections and that the malicious component remained unflagged when checked on May 30, 2026.
Article Details
- Event Type
- OnyxC2 stealer offered as malware-as-a-service.
- Impact
- OnyxC2 is offered for monthly rental, with a higher-priced tier and a private source-code option. BlackFog analyzed two samples and reports capabilities for stealing credentials, cookies, autofill data, and other sensitive information, including through password managers and two-factor authentication extensions. One infected host shown in the stealer's panel reportedly contained 55 saved passwords, 4,717 cookies, and 719 autofill entries.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe stealer provides LSASS dumping, a capability associated with dumping credentials from LSASS memory.T1056.001 · KeyloggingThe stealer includes a keylogger.T1113 · Screen CaptureThe stealer includes screenshot capture.T1574.002 · DLL Side-LoadingThe article describes a malicious DLL disguised as an NVIDIA graphics library being loaded alongside a legitimate application.