OnyxC2 Stealer: $250/Month Buys You Encrypted Payloads and 200+ App Targets
A commodity infostealer is punching well above its price point. OnyxC2 brings DLL sideloading and in-memory execution to anyone with a credit card.
Two-fifty a month. That's the going rate for OnyxC2, a stealer-as-a-service that researchers say targets more than 200 applications and browser extensions. The tooling is not exotic. The price is not exotic. The problem is that it doesn't have to be.
In practice, 'enterprise-grade' is the wrong frame here. What OnyxC2 actually delivers is operational discipline at commodity cost: encrypted payloads to frustrate static analysis, DLL sideloading to blend into legitimate process trees, and in-memory execution to avoid leaving artifacts on disk. Three techniques that separately are well-understood, and together are genuinely annoying to catch at scale.
The failure mode here is endpoint tooling that relies on file-based signatures. In-memory execution specifically bypasses a huge chunk of what traditional AV does well, and DLL sideloading — using a legitimate, signed binary to load a malicious library — is exactly the kind of thing that flies past endpoint detection rules tuned to alert on untrusted process spawns. Your EDR sees a trusted binary. Nothing fires.
Browser extensions and application credential stores are the target surface. Over 200 of them, per the research. Think password manager integrations, session cookie stores, saved credentials in Chromium-based browsers. If a developer's machine gets hit, you're not just looking at their creds — you're potentially looking at cloud console sessions, CI/CD tokens, AWS access keys cached in browser-based tools. The blast radius from a single compromised endpoint in a DevOps environment is large.
One thing the post-mortem will say: the initial access vector was something mundane. Phishing, a cracked tool download, a poisoned package. OnyxC2 doesn't solve initial access for the attacker — it solves what happens after. The $250 gets them persistence and exfiltration that would have cost real development time three years ago.
Defenders running cloud workloads should be thinking about short-lived credentials. AWS IAM roles with session tokens, GCP Workload Identity Federation, Azure Managed Identities — anything that limits the value of a stolen credential to a narrow time window. Static access keys stored anywhere a browser can read them are the gift that keeps giving for stealers like this.
There is no CVE here. This is not a software vulnerability. It's a market.
If your developers have long-lived cloud credentials sitting in browser profiles, OnyxC2 is the least of your problems — it just happens to be today's messenger.
