Loading story…
Recorded Future reported that TAG-195 has expanded its malware-as-a-service ecosystem by evolving its ChonkyChicken post-exploitation implant into Modular ChonkyChicken, a controller-and-plugin framework that fetches capability modules on demand over WebSocket command-and-control. The malware is designed for enterprise lateral movement, reconnaissance, surveillance, browser credential theft, and optional WPAD-based traffic interception, while reducing static footprint by deploying only operator-selected modules during an intrusion.
The report also identified ChromEggscalator, a TAG-195-modified version of the open-source ChromElevator tool, repackaged as an OCX helper to bypass Chrome ABE protections and support browser theft operations. Researchers said the tooling family—including TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator—shares a common development framework marked by filename gating, OCX packaging, regsvr32-based execution through legitimate Windows COM registration paths, JSON tasking over WebSockets, forensic logging, and persistence via Windows Run keys.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Insikt Group stated that TAG-127 has been observed deploying TinyEgg in ClickFix-style campaigns that trick victims into executing malicious commands through fake security verification pages. This connects the newly identified TinyEgg malware to observed delivery activity by a separate threat cluster.
Insikt Group reported that TAG-195 expanded its malware-as-a-service ecosystem with four identified malware families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. The report describes this as an architectural shift toward modular, operator-driven tooling with shared development traits across the families.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcerecordedfuture.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026
Securonix Threat Labs reported that the **OCX#HARVESTER** campaign used phishing emails carrying ZIP archives with disguised `.lnk` files to compromise victims, with activity observed primarily between late 2022 and early 2023. The operation appears tied to the **More_eggs/Golden Chickens** malware ecosystem and likely focused on organizations and individuals linked to the financial sector, particularly cryptocurrency-related entities. After execution, the infection chain launched obfuscated JavaScript loaders and abused multiple Windows living-off-the-land binaries, including `ie4uinit.exe`, `msxsl.exe`, `wmic.exe`, `regsvr32.exe`, `curl.exe`, and `typeperf.exe`, to stage payloads, establish persistence, and communicate with command-and-control infrastructure. Later stages deployed several **OCX#HARVESTER** binaries, including a screenshot-capture component, additional obfuscated implants, and what researchers assessed was likely a **Cobalt Strike** beacon. Operators also retrieved **SharpChrome** to steal Chrome cookies and credentials, expanding the campaign from initial access to credential theft and post-compromise surveillance. The use of `msxsl.exe`, a known LOLBin documented by the LOLBAS project, underscores the campaign's reliance on legitimate Microsoft-signed utilities to blend malicious activity into normal system operations, while shifting command-and-control infrastructure suggests the toolkit remains actively maintained and adapted to evade detection.
Aug 14, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026