OnyxC2 Stealer: $250/Month Buys You Encrypted Payloads and 200+ App Targets

Key points

• OnyxC2 is a stealer-as-a-service priced at $250 a month that researchers say targets more than 200 applications and browser extensions.
• It evades detection through encrypted payloads, DLL sideloading, and in-memory execution.
• Browser credential stores and session cookies are the primary target, making developer machines high-value endpoints.
• Short-lived credentials via AWS IAM roles, GCP Workload Identity Federation, or Azure Managed Identities limit the damage a stolen credential can do.
• No CVE exists for this threat. It's a market, not a vulnerability.

What does OnyxC2 actually do?

Two-fifty a month. That's the going rate for OnyxC2, and what it delivers is operational discipline at commodity cost: encrypted payloads to frustrate static analysis, DLL sideloading to blend into legitimate process trees, and in-memory execution to avoid leaving artifacts on disk. Three techniques that separately are well-understood, and together are genuinely annoying to catch at scale.

The failure mode is endpoint tooling that relies on file-based signatures. In-memory execution bypasses a large chunk of what traditional AV does well. DLL sideloading, which uses a legitimate signed binary to load a malicious library, is exactly the kind of thing that sails past detection rules tuned to alert on untrusted process spawns. Your EDR sees a trusted binary. Nothing fires.

Should you worry about browser-stored credentials?

Over 200 applications and extensions are in scope, per the research. Password manager integrations, session cookie stores, saved credentials in Chromium-based browsers. If a developer's machine gets hit, you're not just looking at their credentials. You're potentially looking at cloud console sessions, CI/CD tokens, AWS access keys cached in browser-based tools. The blast radius from a single compromised endpoint in a DevOps environment is significant enough to warrant real concern.

We've tracked credential-stealer distribution across four cloud-credentials stories since May, two in the past 90 days, and the pattern is consistent: the initial access vector is always mundane. Phishing, a cracked tool download, a poisoned package. OnyxC2 doesn't solve initial access for the attacker. It solves what happens after. The $250 buys persistence and exfiltration capability that would have cost real development time a few years ago.

What should defenders do?

Anyone running cloud workloads should be thinking about short-lived credentials. AWS IAM roles with session tokens, GCP Workload Identity Federation, Azure Managed Identities: anything that limits the value of a stolen credential to a narrow time window. Static access keys stored anywhere a browser can read them are the gift that keeps giving for stealers like this.

There is no CVE here. This is not a software vulnerability. It's a market, and OnyxC2 is a competent product in it. If your developers have long-lived cloud credentials sitting in browser profiles, OnyxC2 is just today's reminder that they shouldn't.