Loading malware…
TinyEgg is a lightweight Windows backdoor associated with the Golden Chickens malware-as-a-service ecosystem, also tracked as Venom Spider or TAG-195. It is designed primarily for initial access, host profiling, and establishment of a foothold before handing off broader post-exploitation activity to later-stage tooling such as ChonkyChicken. Observed functionality includes interactive shell access, command execution, host profiling, command-and-control communications over WebSockets using a task-driven protocol, and persistence management. TinyEgg has also been reported to terminate execution in sandbox or automated analysis environments, indicating built-in defense-evasion logic. Across the TAG-195 toolset, TinyEgg shares architectural traits including OCX packaging, execution through legitimate Windows COM registration mechanisms, string obfuscation, filename-based execution gating, and a consistent persistence model using user-level autorun mechanisms. Delivery has been observed through ClickFix-style social-engineering lures in which victims are tricked into manually executing malicious commands that invoke a legitimate Windows utility to load the staged payload. TinyEgg has been linked to operations involving TAG-127 as a customer or operator within the broader Golden Chickens ecosystem, which has also been associated with financially motivated cybercrime activity affecting enterprise environments.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TinyEgg serves as a lightweight backdoor for initial access and host profiling, passing post-exploitation capabilities to ChonkyChicken.
That action downloads an OCX payload and launches it with regsvr32.exe, allowing the first-stage TinyEgg backdoor to establish access before ChonkyChicken is delivered.
TinyEgg, a lightweight initial-access backdoor providing host profiling, interactive shell access, and persistence management.
TinyEgg, a lightweight initial-access backdoor providing host profiling, interactive shell access, and persistence management.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
The malware establishes connections with a C2 server using WebSockets to facilitate an interactive command shell, run operator-supplied input to the active shell session commands, send the output back to the controller, and stage OCX payloads.
ClickFix-style social engineering campaigns that trick unsuspecting users into manually executing malicious commands. | The threat intelligence company said it has also observed TAG-127 deploying TinyEgg via ClickFix-style social engineering campaigns that trick unsuspecting users into manually executing malicious commands.
That action downloads an OCX payload and launches it with regsvr32.exe, allowing the first-stage TinyEgg backdoor to establish access before ChonkyChicken is delivered.
the payload is staged to a user-writable local application data directory, and a Run key is created that points to the staged file, ensuring execution via a legitimate Windows system utility at each user logon.
the payload is staged to a user-writable local application data directory, and a Run key is created that points to the staged file, ensuring execution via a legitimate Windows system utility at each user logon.
These new families represent an architectural evolution, sharing common command-and-control mechanisms, persistence approaches, string obfuscation, and delivery models.
That action downloads an OCX payload and launches it with regsvr32.exe... All current TAG-195 families share tactics intended to complicate detection... and abuse regsvr32.exe to load OCX files from user-writable locations.
TinyEgg is also designed to terminate execution if sandbox and automated analysis environments are detected.
This shift to modular, operator-driven tooling is seen as a move for defense evasion and to meet commercial incentives within the MaaS model, allowing selective provisioning of capabilities and reducing detection exposure.
TinyEgg serves as a lightweight backdoor for initial access and host profiling, passing post-exploitation capabilities to ChonkyChicken.
TinyEgg, a lightweight initial-access backdoor providing host profiling... The malware's functionality is limited to initial access and profiling functions
TinyEgg is also designed to terminate execution if sandbox and automated analysis environments are detected.
The malware establishes connections with a C2 server using WebSockets to facilitate an interactive command shell...
Attack chains have been found to leverage ClickFix lures to execute OCX payloads downloaded from attacker-controlled staging infrastructure, resulting in the installation of TinyEgg.
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.