TAG-195 Evolves Its Malware-as-a-Service Toolkit with Four New Malware Families
Summary
Recorded Future details four new TAG-195 malware families, including a modular ChonkyChicken variant that loads capabilities on demand. The tools support credential theft, surveillance, reconnaissance and lateral movement, with ClickFix observed for initial access.
Key points
- The four families are TinyEgg, ChonkyChicken, modularized ChonkyChicken, and ChromEggscalator, a modified Chrome encryption-bypass helper.
- TAG-127 was observed using ClickFix-style fake verification pages to get victims to execute commands that download and install TinyEgg through a legitimate Windows utility.
- TinyEgg serves as an initial-access implant; it can download ChonkyChicken, which adds browser credential theft, live browser-session control, network reconnaissance, lateral movement and surveillance.
- Modular ChonkyChicken uses a controller that requests and loads capability plugins on demand; researchers identified at least 14 modules.
- The families share traits including filename-based execution checks, OCX packaging, string obfuscation, WebSocket command-and-control, and Run-key persistence.
- The report recommends detecting ClickFix clipboard execution, suspicious use of legitimate utilities and startup persistence, browsers launched with remote debugging, and unusual outbound connections.
Article Details
- Attack Vectors
- TAG-127 used ClickFix lure pages that prompted victims to paste and execute commands, downloading OCX payloads from attacker-controlled staging infrastructure.
- TinyEgg payloads were executed through regsvr32.exe, then could download and execute ChonkyChicken as a second-stage implant.
- ChonkyChicken used a staged helper to extract browser credentials and supported live browser-session control through Chrome DevTools Protocol.
- ChonkyChicken supported credential- and token-backed remote execution, network reconnaissance, and persistent collection of keystrokes, clipboard contents, audio, and screen captures.
- Modular ChonkyChicken requested capability modules from C2, decoded them, wrote them to temporary files, and loaded them into memory.
- Defensive Notes
- Prioritize detection of ClickFix-style clipboard execution chains and misuse of regsvr32.exe to load payloads from user-writable directories.
- Monitor suspicious Run key persistence, including the WinComCtl value, and investigate the associated staged OCX files.
- Detect Chrome or Edge processes launched with remote debugging enabled and investigate unusual outbound WebSocket communications.
- Treat %TEMP%\lg.txt and C:\ProgramData\xlog.txt as forensic indicators of ChonkyChicken and ChromEggscalator execution attempts, respectively.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | screenly[.]cam | ClickFix lure domain leveraged by TAG-127 to distribute malware. |
| DOMAIN | xtrafftrck[.]net | Dedicated attacker-controlled domain used for payload staging and C2. |
| IPV4 | 70[.]34[.]205[.]43 | Shared IP address used by the four lure domains in TAG-127 malware delivery infrastructure. |
MITRE ATT&CK
T1018 · Remote System DiscoveryChonkyChicken used ARP-based host discovery to identify active hosts on the victim network.T1027 · Obfuscated Files or InformationThe article reports XOR- or AES-encrypted strings in TAG-195 malware.T1041 · Exfiltration Over C2 ChannelChonkyChicken packaged extracted browser credential material and sent it to the controller.T1046 · Network Service DiscoveryChonkyChicken scanned TCP ports to identify active network services.T1053.005 · Scheduled TaskChonkyChicken retained command strings for creating, executing, and deleting remote scheduled tasks.T1056.001 · KeyloggingChonkyChicken recorded keystrokes and associated them with active window titles.T1071.001 · Web ProtocolsTinyEgg, ChonkyChicken, and Modular ChonkyChicken used WebSocket communications for tasking and C2.T1105 · Ingress Tool TransferTinyEgg downloaded payloads, and Modular ChonkyChicken retrieved capability modules from C2.T1113 · Screen CaptureChonkyChicken captured screen frames and transmitted them over WebSocket.T1115 · Clipboard DataChonkyChicken monitored the clipboard and collected plaintext contents.T1123 · Audio CaptureChonkyChicken captured audio and returned Base64-encoded WAV recordings.T1134 · Access Token ManipulationChonkyChicken supported token-based execution through token_run and used APIs for token manipulation.T1185 · Browser Session HijackingChonkyChicken enabled operators to control live authenticated browser sessions through Chrome DevTools Protocol.T1204.004 · Malicious Copy and PasteClickFix lure pages instructed victims to copy a command to the clipboard and manually paste and execute it.T1218.010 · Regsvr32TAG-195 OCX payloads were executed through the legitimate Windows utility regsvr32.exe.T1547.001 · Registry Run Keys / Startup FolderTinyEgg and ChonkyChicken created a Run key persistence entry named WinComCtl.T1555.003 · Credentials from Web BrowsersChonkyChicken used ChromEggscalator in a workflow to extract browser credentials.
Threat Actors
Cobalt GroupPublic reporting by eSentire previously linked TAG-195 tooling to this financially motivated criminal group.EvilNumPublic reporting by eSentire previously linked TAG-195 tooling to this financially motivated criminal group.FIN6Public reporting by eSentire previously linked TAG-195 tooling to this financially motivated criminal group.Golden ChickensAlternate name the article gives for TAG-195.TAG-127Threat group reported to use TAG-195 MaaS tooling and observed deploying TinyEgg through ClickFix-style campaigns.TAG-195Financially motivated MaaS developer associated with the malware ecosystem; the article identifies Golden Chickens and Venom Spider as alternate names.Venom SpiderAlternate name the article gives for TAG-195.
Malware
ChonkyChickenWe named two of the families "TinyEgg" and “ChonkyChicken"; the third is a modularized variant of ChonkyChicken.ChromEggscalatorThe fourth family, which includes a modified browser credential theft helper, we named “ChromEggscalator".Modular ChonkyChickenModular ChonkyChicken realizes the modular architecture TerraLogger hinted at.RevC2The progression from RevC2, TerraStealerV2, and TerraLogger to the current generation of TinyEgg, ChonkyChicken, ChromEggscalator, and Modular ChonkyChicken indicates a deliberate architectural transition rather thanTerraLoggerGroup previously reported on this development trajectory in April 2025, identifying TerraStealerV2 and TerraLogger as new TAG-195 malware families reflecting ongoing development aimed at credential theft and keylogging.TerraStealerV2Insikt Group previously reported on this development trajectory in April 2025, identifying TerraStealerV2 and TerraLogger as new TAG-195 malware families reflecting ongoing development aimed at credential theft andTinyEggWe named two of the families "TinyEgg" and “ChonkyChicken"; the third is a modularized variant of ChonkyChicken.
Products
EdgeThe cdp_start command launches the Chrome or Edge browser off-screen using negative window coordinates, enables remote debugging, and removes Chromium singleton artifacts before connecting to the local CDP endpoint.Google ChromeTAG-195 also modified a publicly available Chrome encryption-bypass tool into a custom helper within the malware family that Insikt Group named ChromEggscalator.Microsoft Windowsinto manually executing malicious commands that download and install malware payloads via a legitimate Windows system utility.)
Tools
ChromElevatorChromEggscalator is a TAG-195-modified version of ChromElevator, a publicly available open-source Chrome ABE bypass tool.WiresharkWhile this masking is easily reversible for analysts using standard tools such as Wireshark, signature-based intrusion detection systems cannot inspect WebSocket payload content without first implementing frame