OnyxC2 is a sophisticated malware-as-a-service platform sold on cybercrime networks for $250 monthly. It includes a web panel and payload builder, targeting 210 applications across nine categories, notably including 45 browsers, 109 extensions (including 2FA tools), 5 password managers, and 17 cryptocurrency wallets. The malware uses mutated builds to evade detection at a 99% rate and employs DLL sideloading via signed binaries for delivery. Higher subscription tiers unlock remote access features such as hidden VNC, LSASS credential dumping, reverse SOCKS5 proxy, keylogging, and reverse shell capabilities. Distribution is conducted through fake installers delivered as password-protected archives. The malware communicates with its command and control server over HTTPS fronted by Cloudflare, specifically to the domain akmuniverstall.top. There is no indication of known exploits in the wild or vendor patches, as this is a malware threat rather than a software vulnerability.

OnyxC2 compromises user credentials and sensitive data by stealing information from a wide range of applications including browsers, extensions, password managers, and cryptocurrency wallets. The malware's advanced evasion techniques reduce detection likelihood, increasing the risk of prolonged undetected access. Its remote access capabilities enable attackers to perform credential dumping, keylogging, and establish reverse shells, potentially leading to full system compromise and lateral movement within networks. The theft of two-factor authentication tokens and cryptocurrency wallets poses significant risks to account security and financial assets.

No official patches or fixes exist as this is malware rather than a software vulnerability. Mitigation focuses on detection and prevention measures such as blocking the identified command and control domain (akmuniverstall.top), monitoring for the listed malware hashes, and preventing DLL sideloading attacks by enforcing application whitelisting and validating signed binaries. Users should avoid executing software from untrusted sources, especially password-protected archives and fake installers. Endpoint detection and response solutions should be updated to recognize mutated variants of this malware. Network defenses should monitor for unusual HTTPS traffic to Cloudflare-fronted domains associated with this threat.