Loading malware…
ChonkyChicken is a Windows remote access trojan and second-stage post-exploitation implant associated with the TAG-195 malware-as-a-service ecosystem, also known as Golden Chickens or Venom Spider. It is designed to expand an initial foothold into broader enterprise compromise by combining browser credential theft, live browser session abuse, reconnaissance, lateral movement, remote execution, persistence, and surveillance in a single framework.
ChonkyChicken is typically deployed after the TinyEgg backdoor establishes initial access. Observed delivery chains tied to the broader ecosystem have used ClickFix-style social-engineering lures that trick victims into manually executing malicious commands, leading to staged OCX payload execution through legitimate Windows COM registration mechanisms. Across the TAG-195 toolset, shared traits include OCX packaging, execution through Windows registration utilities, WebSocket-based command and control, string obfuscation, filename-gating checks, and persistence through Windows Run-key mechanisms.
A defining capability of ChonkyChicken is browser-focused theft and session abuse. It can steal browser credentials and other protected browser secrets with the aid of ChromEggscalator, a modified Chrome encryption-bypass helper integrated into its workflow. It can also automate and control live Chrome or Edge sessions through Chrome DevTools Protocol, allowing operators to interact with already authenticated browser contexts and inspect logged-in sessions without necessarily triggering fresh authentication events. This makes it particularly useful for accessing business services through stolen or hijacked browser state.
ChonkyChicken also supports credential-backed and token-based remote execution for lateral movement. Its operators can use available credentials or access tokens to pivot from the initially compromised endpoint into other systems. Network discovery functions include host discovery, port scanning, share enumeration, and broader environment profiling, enabling the malware to identify reachable services and accessible internal resources. The implant is therefore suited to turning a single infected workstation into a pivot point for deeper network intrusion.
Surveillance and collection features include keylogging, clipboard capture, screenshot collection, audio recording, and monitor enumeration. Some reporting also describes a retained helper workflow for WPAD-related traffic interception. Persistence is maintained through user-level autorun mechanisms, and the malware can also remove its own persistence artifacts when directed.
A modularized successor or variant of ChonkyChicken has also been observed, using a controller-and-plugin architecture that can fetch capability modules on demand. This modular evolution likely reduces the static footprint of the base implant and supports selective capability deployment for different operators or intrusion objectives. ChonkyChicken and its related tooling are part of a financially motivated criminal malware ecosystem that has also been linked to multiple downstream threat actors using Golden Chickens services.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
ChonkyChicken is a more advanced implant with features like browser credential theft and live browser session control.
ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance.
ChonkyChicken, a fully featured implant that expands on TinyEgg with browser credential theft, live browser session control using Chrome DevTools Protocol (CDP), credential-backed remote execution, network reconnaissance, and sustained surveillance.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
The implant imports Windows APIs for credential use and token manipulation, and retains command strings for the creation, execution, and deletion of remote scheduled tasks.
The malware establishes connections with a C2 server using WebSockets to facilitate an interactive command shell, run operator-supplied input to the active shell session commands, send the output back to the controller, and stage OCX payloads.
Recent campaigns begin with ClickFix lures, fake verification pages that persuade targets to paste a copied command into the Windows Run dialog.
That action downloads an OCX payload and launches it with regsvr32.exe, allowing the first-stage TinyEgg backdoor to establish access before ChonkyChicken is delivered.
The implant imports Windows APIs for credential use and token manipulation, and retains command strings for the creation, execution, and deletion of remote scheduled tasks.
They use filename checks to avoid running in unwanted environments, keep persistence through Windows Run keys...
The implant imports Windows APIs for credential use and token manipulation, and retains command strings for the creation, execution, and deletion of remote scheduled tasks.
The implant imports Windows APIs for credential use and token manipulation... Credential-backed execution via cred_exec and token-based execution via token_run provide operators with multiple paths to move laterally
They use filename checks to avoid running in unwanted environments, keep persistence through Windows Run keys...
These new families represent an architectural evolution, sharing common command-and-control mechanisms, persistence approaches, string obfuscation, and delivery models.
The modularized ChonkyChicken introduces a controller-and-plugin architecture, allowing for on-demand loading of 14 distinct capability modules...
The implant imports Windows APIs for credential use and token manipulation... Credential-backed execution via cred_exec and token-based execution via token_run provide operators with multiple paths to move laterally
That action downloads an OCX payload and launches it with regsvr32.exe... All current TAG-195 families share tactics intended to complicate detection... and abuse regsvr32.exe to load OCX files from user-writable locations.
This shift to modular, operator-driven tooling is seen as a move for defense evasion and to meet commercial incentives within the MaaS model, allowing selective provisioning of capabilities and reducing detection exposure.
The modularized ChonkyChicken introduces a controller-and-plugin architecture, allowing for on-demand loading of 14 distinct capability modules, including process management, screen capture, keylogging, and browser theft.
ChonkyChicken is a more advanced implant with features like browser credential theft and live browser session control.
ChonkyChicken is a more advanced implant with features like browser credential theft and live browser session control.
ChonkyChicken, a fully featured implant that expands on TinyEgg with browser credential theft... ChromEggscalator, a successor to TerraStealerV2 and a modified version of a publicly available Chrome encryption-bypass tool called ChromElevator
ChonkyChicken retains a Web Proxy Auto-Discovery (WPAD) helper workflow that, when operational, positions the implant as a network proxy capable of intercepting victim network traffic.
ChonkyChicken can use available credentials or access tokens... scan ports, discover hosts, and identify accessible network shares.
ARP-based host discovery via net_arp_scan returns active hosts with their IP addresses, hostnames, and MAC addresses.
The remote_logon capability is particularly notable from a detection standpoint: it passively enumerates logged-on sessions without submitting credentials, generating no authentication events.
TCP port scanning via net_port_scan identifies active services, including SMB, RDP, WinRM, SQL Server, PostgreSQL, HTTP/S, and SSH. | The net_enumerate workflow combines ARP discovery, NetBIOS resolution, TCP scanning, and SMB enumeration into a single operation, returning IP address, MAC address, hostname, fully qualified domain name, domain name, operating system, and open ports.
The modularized ChonkyChicken introduces a controller-and-plugin architecture, allowing for on-demand loading of 14 distinct capability modules, including process management, screen capture, keylogging, and browser theft.
The net_enumerate workflow combines ARP discovery, NetBIOS resolution, TCP scanning, and SMB enumeration into a single operation, returning IP address, MAC address, hostname, fully qualified domain name, domain name, operating system, and open ports.
The 14 modules enable the following functions - ... File manipulation
ChonkyChicken can use available credentials or access tokens... identify accessible network shares.
The 14 modules enable the following functions ... Domain-based reconnaissance
ChonkyChicken, a fully featured implant that expands on TinyEgg with ... credential-backed remote execution...
ChonkyChicken can use available credentials or access tokens... create remote scheduled tasks...
Credential-backed execution via cred_exec and token-based execution via token_run provide operators with multiple paths to move laterally, depending on the credentials or tokens available on the host.
The modularized ChonkyChicken introduces a controller-and-plugin architecture, allowing for on-demand loading of 14 distinct capability modules, including process management, screen capture, keylogging, and browser theft.
Detects creation of the lg.txt debug log in AppData\Local\Temp, which has been observed during TAG-195's ChonkyChicken DllInstall gating and early agent execution.
The modularized ChonkyChicken introduces a controller-and-plugin architecture, allowing for on-demand loading of 14 distinct capability modules, including process management, screen capture, keylogging, and browser theft.
ChonkyChicken also collects keystrokes, clipboard contents, audio recordings, and screenshots, giving attackers ongoing visibility into victim activity.
ChonkyChicken also collects keystrokes, clipboard contents, audio recordings, and screenshots, giving attackers ongoing visibility into victim activity.
ChonkyChicken retains a Web Proxy Auto-Discovery (WPAD) helper workflow that, when operational, positions the implant as a network proxy capable of intercepting victim network traffic.
WebSocket-based C2 using a JSON-formatted, task-driven protocol
The 14 modules enable the following functions - ... HTTP/S request via host
Attack chains have been found to leverage ClickFix lures to execute OCX payloads downloaded from attacker-controlled staging infrastructure, resulting in the installation of TinyEgg.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.