TAG-127

TAG-127 is a financially motivated cybercriminal threat actor associated with the Golden Chickens malware-as-a-service ecosystem, also tracked through the developer cluster TAG-195 and widely linked to the Golden Chickens and Venom Spider tooling lineage. TAG-127 has been observed as an operator and customer of this ecosystem, deploying TinyEgg through ClickFix-style social-engineering campaigns and also using VenomLNK as a delivery method. TAG-127 intrusion chains rely on user execution of malicious commands presented through fake security verification lures. These campaigns deliver TinyEgg as a lightweight initial-access backdoor, after which broader post-exploitation capability can be handed off to later-stage Golden Chickens tooling such as ChonkyChicken. TinyEgg supports host profiling, interactive shell access, and persistence management, enabling operators to establish and maintain footholds before deploying more capable implants. Activity associated with TAG-127 and the related Golden Chickens tooling demonstrates capabilities spanning initial access, persistence, credential theft, session hijacking, reconnaissance, lateral movement, post-exploitation, defense evasion, keylogging, and exfiltration. The associated tooling has been documented stealing browser credentials, bypassing Chrome protections through ChromEggscalator, manipulating authenticated browser sessions through Chrome DevTools Protocol automation, conducting network and domain reconnaissance, creating remote scheduled tasks, scanning ports, identifying accessible network shares, and collecting keystrokes, clipboard data, screenshots, and audio recordings. The malware ecosystem also uses string obfuscation, filename-based execution gating, abuse of legitimate Windows utilities for payload execution, and Run key persistence. TAG-127 should be understood as part of a broader financially motivated criminal ecosystem rather than a nation-state actor. Its observed tradecraft is consistent with access operations intended to support downstream fraud, account compromise, and broader network intrusion using modular malware supplied by Golden Chickens/Venom Spider.