Loading malware…
ChromEggscalator is a Windows-based browser credential theft helper associated with the TAG-195 malware-as-a-service ecosystem, also known as Golden Chickens or Venom Spider. It is a modified successor to TerraStealerV2 and derives from the publicly available ChromElevator Chrome encryption-bypass tool. Rather than operating as a broad standalone implant, it appears to function as a dedicated component within TAG-195 intrusion workflows, especially alongside the ChonkyChicken malware family.
Its primary role is to bypass Chrome App-Bound Encryption protections and extract protected browser secrets from Chromium-based browsers. It has been observed integrated into ChonkyChicken’s staged browser-theft workflow, where it is executed as a helper and its output is collected and exfiltrated by the parent implant. TAG-195 modified the original tooling by removing the command-line interface, repackaging it as an OCX component, and adding execution-gating logic tied to expected filename conditions, consistent with the ecosystem’s broader emphasis on defense evasion and controlled operator deployment.
ChromEggscalator is part of a broader architectural shift in the Golden Chickens ecosystem toward modular, operator-driven tooling. Across related families, TAG-195 uses shared command-and-control patterns, persistence approaches, string obfuscation, and staged execution methods. In this context, ChromEggscalator serves as a specialized browser-theft module that complements post-exploitation activity by enabling theft of protected browser credentials and secrets from compromised Windows endpoints. Its use supports financially motivated intrusions in which operators seek access to enterprise services, authenticated browser data, and follow-on opportunities for deeper compromise.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
ChromEggscalator is a modified version of a publicly available Chrome encryption-bypass tool.
ChonkyChicken uses a tailored helper named ChromEggscalator to bypass Chrome App-Bound Encryption protections and collect protected browser secrets.
ChromEggscalator, a successor to TerraStealerV2 and a modified version of a publicly available Chrome encryption-bypass tool called ChromElevator.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
These new families represent an architectural evolution, sharing common command-and-control mechanisms, persistence approaches, string obfuscation, and delivery models.
That action downloads an OCX payload and launches it with regsvr32.exe... All current TAG-195 families share tactics intended to complicate detection... and abuse regsvr32.exe to load OCX files from user-writable locations.
This shift to modular, operator-driven tooling is seen as a move for defense evasion and to meet commercial incentives within the MaaS model, allowing selective provisioning of capabilities and reducing detection exposure.
ChonkyChicken uses a tailored helper named ChromEggscalator to bypass Chrome App-Bound Encryption protections and collect protected browser secrets.
ChonkyChicken, a fully featured implant that expands on TinyEgg with browser credential theft... ChromEggscalator, a successor to TerraStealerV2 and a modified version of a publicly available Chrome encryption-bypass tool called ChromElevator
Detects creation of the lg.txt debug log in AppData\Local\Temp, which has been observed during TAG-195's ChonkyChicken DllInstall gating and early agent execution.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.