OnyxC2 Fake Installer Lure Execution

Duo Tech@duotech

•updated Jun 15, 2026•1•0•9

Detects the execution of specific file names used as fake installers for the OnyxC2 stealer, which are typically delivered in password-protected archives.