OnyxC2 MaaS Infostealer Surfaces on Cybercrime Forums at $250/Month; Targets 210+ Apps via Cloudflare-Fronted C2 and Signed-Binary DLL Sideloading

BlackFog researchers detailed OnyxC2, a new malware-as-a-service credential stealer actively sold on cybercrime forums for $250/month that targets over 210 applications — including browsers, password managers, 2FA extensions, cryptocurrency wallets, VPNs, and FTP clients — exfiltrating data over Cloudflare-fronted HTTPS to evade network-layer detection. Each build is uniquely mutated using C++ with direct assembly syscalls, delivered via DLL sideloading through a legitimately signed OneDrive binary, with the payload remaining AES-256 encrypted until runtime; developers offer refund guarantees for detected builds and claim a 99% evasion rate backed by low initial VirusTotal detection on uploaded samples. Defenders should hunt for signed OneDrive binary anomalies executing unexpected child processes, unexpected Cloudflare-proxied C2 beaconing, and the default backend path /backend/api/app.php in proxy logs.

Defenders should hunt for signed OneDrive binary anomalies executing unexpected child processes, unexpected Cloudflare-proxied C2 beaconing, and the default backend path /backend/api/app.php in proxy logs.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.