A new malware-as-a-service platform called OnyxC2 has emerged targeting credentials from 210 different applications including browsers, cryptocurrency wallets, password managers, and messaging platforms. This commercially available malware framework enables threat actors to deploy information-stealing capabilities through a subscription-based model, significantly lowering the barrier to entry for cybercriminals. Security researchers have identified multiple active campaigns leveraging OnyxC2 to exfiltrate sensitive data, posing substantial risks to both individual users and enterprise environments.
Introduction
The cybersecurity landscape continues to evolve as threat actors adopt business-oriented models to distribute malicious capabilities. OnyxC2 represents the latest iteration of malware-as-a-service (MaaS) platforms, offering comprehensive credential theft functionality targeting an extensive range of applications. Unlike traditional malware that requires technical expertise to develop and deploy, OnyxC2 democratizes cybercrime by providing a turnkey solution complete with command-and-control infrastructure, automated data exfiltration, and user-friendly management interfaces.
This development signals a concerning trend where sophisticated attack capabilities become accessible to lower-skilled threat actors, potentially multiplying the volume and frequency of credential theft operations worldwide. The malware’s ability to target 210 distinct applications demonstrates the comprehensive approach attackers are taking to harvest valuable authentication data.
Background & Context
Malware-as-a-service platforms have proliferated over the past several years, following the successful models established by ransomware-as-a-service operations. These platforms operate on subscription or revenue-sharing models, where developers maintain the malware infrastructure while affiliates conduct actual attacks.
OnyxC2 emerged in underground forums approximately three months ago, initially targeting Russian-speaking cybercriminal communities before expanding to English-language marketplaces. The service is advertised with tiered pricing structures ranging from $150 to $500 monthly, depending on feature sets and support levels. Developers promote its “undetectable” capabilities and continuous updates to evade security solutions.
The malware builds upon techniques observed in previous information stealers like RedLine, Raccoon, and Vidar, but incorporates additional obfuscation methods and expanded application targeting. Its modular architecture allows operators to customize which data types to harvest, enabling targeted campaigns based on specific objectives.
Technical Breakdown
OnyxC2 operates through a multi-stage infection chain beginning with various delivery mechanisms including phishing emails, malicious advertisements, software cracks, and trojanized legitimate applications. Once executed, the malware establishes persistence through registry modifications and scheduled tasks.
Core Functionality
The malware implements several sophisticated techniques:
Data Harvesting Module: Scans file systems and application directories for stored credentials, cookies, autofill data, and browsing history from browsers including Chrome, Firefox, Edge, Opera, and Brave. It targets both Windows Credential Manager and third-party password managers like LastPass, 1Password, and KeePass databases.
Cryptocurrency Wallet Targeting: Specifically searches for wallet files and browser extensions associated with 40+ cryptocurrency platforms including MetaMask, Exodus, Electrum, and hardware wallet management software. Private keys and seed phrases stored in text files are also harvested.
Application-Specific Extractors: Contains specialized modules for extracting authentication tokens from:
- Gaming platforms (Steam, Epic Games, Discord)
- VPN clients (NordVPN, ExpressVPN, ProtonVPN)
- FTP clients (FileZilla, WinSCP)
- Messaging applications (Telegram, Signal session data)
- Email clients (Outlook, Thunderbird)
Technical Implementation
The malware utilizes multiple anti-analysis techniques:
# Obfuscation pattern observed in OnyxC2 samples
def check_environment():
# VM detection
vm_indicators = ['VMware', 'VirtualBox', 'QEMU']
# Sandbox detection
if process_count() < 30:
terminate()
# Debugger detection
if is_debugger_present():
execute_junk_code()Network Communication: OnyxC2 employs encrypted C2 communications using custom protocols over HTTPS, making traffic analysis challenging. Exfiltrated data is compressed and encrypted before transmission to attacker-controlled servers.
File System Operations: Harvested credentials are temporarily stored in memory or encrypted temporary files before exfiltration, minimizing forensic traces on compromised systems.
# Typical file locations targeted by OnyxC2
%APPDATA%\Local\Google\Chrome\User Data\Default\Login Data
%APPDATA%\Roaming\FileZilla\recentservers.xml
%USERPROFILE%\.ssh\Impact & Risk Assessment
The proliferation of OnyxC2 presents significant risks across multiple dimensions:
Individual Users: Compromised credentials enable account takeovers across personal banking, social media, email, and cryptocurrency holdings. The average user targeted by OnyxC2 faces potential financial losses ranging from hundreds to tens of thousands of dollars, particularly if cryptocurrency wallets are compromised.
Enterprise Environments: Corporate credentials harvested from employee systems provide initial access vectors for broader network compromise. VPN credentials, SSH keys, and stored cloud service tokens enable lateral movement and privilege escalation within organizational networks.
Supply Chain Risks: Developers and IT administrators with access to production environments represent high-value targets. Compromised credentials could facilitate software supply chain attacks affecting downstream customers.
Financial Sector: The targeting of 40+ cryptocurrency platforms specifically threatens digital asset holders and exchanges. Stolen wallet credentials have resulted in documented losses exceeding $2 million across identified campaigns.
Security researchers estimate OnyxC2 has been deployed in campaigns affecting between 50,000 to 100,000 systems globally, with concentrations in North America, Europe, and Asia-Pacific regions. The actual number may be significantly higher given detection challenges.
Vendor Response
Multiple security vendors have incorporated OnyxC2 detection signatures into their products. Microsoft Defender identifies variants as "Trojan:Win32/OnyxStealer" while other vendors use classifications like "InfoStealer.OnyxC2" or "Stealer.Onyx."
Browser vendors including Google and Mozilla have implemented additional protections for credential storage, though these measures don't fully mitigate risks from already-compromised systems. Cryptocurrency wallet providers have issued advisories recommending hardware wallet usage and warning against storing seed phrases digitally.
Law enforcement agencies in several countries have initiated investigations into OnyxC2 infrastructure, though the operators' use of bulletproof hosting and cryptocurrency payments complicates attribution and takedown efforts.
Security research organizations have published indicators of compromise (IOCs) and YARA rules for community detection efforts. Several C2 servers have been identified and blocklisted, though operators rapidly deploy new infrastructure.
Mitigations & Workarounds
Organizations and individuals should implement multiple defensive layers:
Immediate Actions:
- Change passwords for all critical accounts using unique, complex credentials
- Enable multi-factor authentication across all supported services
- Rotate API keys, tokens, and SSH keys
- Transfer cryptocurrency assets to new wallets with fresh seed phrases
- Scan systems with updated antivirus solutions
Technical Controls:
# Check for suspicious scheduled tasks (Windows)
schtasks /query /fo LIST /v | findstr /i "onyx"
# Review startup items
wmic startup list full
# Check for suspicious network connections
netstat -ano | findstr "ESTABLISHED"
Application Hardening:
- Configure browsers to clear cookies on exit
- Disable password saving in browsers where possible
- Implement application whitelisting
- Use hardware security keys for authentication
- Enable credential guard on Windows systems
Network Segmentation: Isolate systems containing sensitive credentials from general-purpose workstations. Implement zero-trust architectures where feasible.
Detection & Monitoring
Security teams should implement comprehensive monitoring strategies:
Endpoint Detection:
Monitor for suspicious file access patterns targeting credential stores:
# Example Sigma rule concept for OnyxC2 behavior
detection:
selection:
EventID: 4663
ObjectName|contains:
- '\Login Data'
- '\Cookies'
- '\Wallets\'
- '\.ssh\id_rsa'
ProcessName|endswith: '.exe'
condition: selection and rapid_access_multiple_targetsNetwork Indicators:
- Monitor for unusual HTTPS POST requests with encrypted payloads
- Track connections to known OnyxC2 C2 infrastructure
- Identify data exfiltration patterns exceeding baseline thresholds
Behavioral Analytics:
- Detect credential access from unusual processes
- Alert on browser database file access by non-browser executables
- Monitor for temporary file creation followed by immediate network activity
Log Analysis: Review authentication logs for impossible travel scenarios or multiple simultaneous login attempts following credential harvesting timeframes.
Best Practices
Comprehensive security requires layered defensive strategies:
Credential Management:
- Implement password managers with master password protection
- Use unique credentials for every service
- Rotate passwords quarterly for high-value accounts
- Leverage hardware tokens for sensitive operations
User Education:
- Train personnel to recognize phishing attempts
- Establish verification procedures for unexpected attachments
- Promote security awareness regarding software sources
- Encourage reporting of suspicious system behavior
System Hygiene:
- Maintain current patch levels across all software
- Remove unnecessary applications reducing attack surface
- Implement least-privilege access principles
- Regularly audit installed software and browser extensions
Backup Strategies:
- Maintain offline backups of critical data
- Document and securely store recovery phrases
- Test restoration procedures regularly
- Encrypt sensitive backup data
Organizational Policies:
- Establish incident response procedures for credential compromise
- Implement mandatory MFA for administrative access
- Deploy EDR solutions with behavioral detection
- Conduct regular security assessments and penetration testing
Key Takeaways
- OnyxC2 represents a sophisticated malware-as-a-service platform targeting credentials from 210 applications including browsers, cryptocurrency wallets, and enterprise tools
- The service operates on a subscription model, lowering barriers for threat actors to conduct credential theft campaigns
- Multi-layered defenses including MFA, password managers, and endpoint detection are essential for protection
- Organizations must implement comprehensive monitoring to detect credential harvesting activities
- Individual users should immediately change passwords, enable MFA, and rotate cryptocurrency wallet seed phrases
- The commoditization of advanced malware capabilities through MaaS platforms will continue driving increased credential theft operations
- Proactive security measures and user education remain critical defenses against evolving information stealer threats
References
- MITRE ATT&CK Technique T1555: Credentials from Password Stores
- MITRE ATT&CK Technique T1539: Steal Web Session Cookie
- MITRE ATT&CK Technique T1552.001: Credentials In Files
- National Cyber Security Centre: Password Manager Guidance
- OWASP Authentication Cheat Sheet
- CISA Alert: Information Stealer Malware Campaigns
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
