OnyxC2 Malware Targets 200+ Apps and Browser Extensions with Stealthy
Techniques
Security
researchers have published detailed analysis of OnyxC2, a sophisticated
command-and-control malware framework that targets more than 200 applications
and browser extensions. What makes OnyxC2 particularly dangerous is its use of
multiple advanced evasion techniques, including encrypted payloads, DLL
sideloading, and in-memory execution, which allow it to operate without writing
malicious files to disk.
OnyxC2 is
believed to be used by a well-organized threat group conducting espionage and
data theft operations. The malware's broad targeting scope — spanning browsers,
email clients, password managers, cryptocurrency wallets, and productivity
tools — enables comprehensive credential and data theft from compromised
systems.
The use of
in-memory execution is especially concerning as it significantly complicates
forensic investigation and evades many traditional antivirus solutions that
rely on scanning files on disk. Security researchers recommend deploying
endpoint detection and response platforms capable of detecting memory-resident
threats.
Organizations
should ensure their security tools are updated with the latest OnyxC2
indicators of compromise and consider implementing application allowlisting to
prevent unauthorized software from executing. Security awareness training that
emphasizes the risk of phishing as OnyxC2's primary delivery mechanism is also
strongly recommended.
Comments