TAG-195 Expands ChonkyChicken Malware With Modular Plugins and Chrome Theft Helper

Recorded Future reported that TAG-195 has expanded its malware-as-a-service ecosystem by evolving its ChonkyChicken post-exploitation implant into Modular ChonkyChicken, a controller-and-plugin framework that fetches capability modules on demand over WebSocket command-and-control. The malware is designed for enterprise lateral movement, reconnaissance, surveillance, browser credential theft, and optional WPAD-based traffic interception, while reducing static footprint by deploying only operator-selected modules during an intrusion.

The report also identified ChromEggscalator, a TAG-195-modified version of the open-source ChromElevator tool, repackaged as an OCX helper to bypass Chrome ABE protections and support browser theft operations. Researchers said the tooling family—including TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator—shares a common development framework marked by filename gating, OCX packaging, regsvr32-based execution through legitimate Windows COM registration paths, JSON tasking over WebSockets, forensic logging, and persistence via Windows Run keys.