A newly identified remote access trojan called ChonkyChicken malware has emerged as a sophisticated threat that transforms infected Windows devices into platforms for credential theft, network reconnaissance, and ongoing surveillance. The malware belongs to the TAG-195 ecosystem, also known as Golden Chickens or Venom Spider, which operates as a malware-as-a-service operation supplying tools to financially motivated cybercriminals.
Analysts at Recorded Future’s Insikt Group discovered the threat while monitoring the evolving TAG-195 infrastructure. According to a report shared with Cyber Security News, ChonkyChicken functions as a second-stage implant combining browser credential theft, interactive session control, remote execution capabilities, reconnaissance functions, and sustained monitoring within a single framework.
How Does the Infection Chain Work?
Recent campaigns deploy ClickFix social engineering lures that present fake verification pages to targets. These deceptive pages convince victims to paste a copied command into the Windows Run dialog box. This action downloads an OCX payload and launches it using regsvr32.exe, establishing initial access through the first-stage TinyEgg backdoor before deploying ChonkyChicken.
What Makes ChonkyChicken Different from Basic Password Stealers?
ChonkyChicken employs a specialized helper tool named ChromEggscalator to bypass Chrome App-Bound Encryption protections and extract protected browser secrets. The malware downloads this helper component, places it in a temporary directory, executes it through a Windows utility, and transmits the collected credential material back to its command-and-control infrastructure.
Beyond simple password theft, the malware can control live Chrome or Edge browser sessions through Chrome DevTools Protocol automation. It launches browsers invisibly with remote debugging enabled, allowing operators to interact with already authenticated sessions. This capability means password resets alone cannot eliminate an attacker who maintains an active browser session.
What Lateral Movement Capabilities Does It Possess?
The threat distinguishes itself through extensive lateral movement features that provide operators multiple routes across compromised networks. ChonkyChicken can leverage available credentials or access tokens, check logged-in sessions without generating authentication events, create remote scheduled tasks, scan network ports, discover hosts, and identify accessible network shares. These capabilities position it as a tool for understanding organizational network topology and using compromised endpoints as stepping stones.
What Surveillance Functions Are Included?
ChonkyChicken collects keystrokes, clipboard contents, audio recordings, and screenshots to provide attackers continuous visibility into victim activity. A separate modular version can request at least 14 capability plugins only when needed, reducing the initial malicious code footprint on infected devices.
How Can Organizations Defend Against This Threat?
All current TAG-195 malware families share anti-detection tactics including filename checks to avoid unwanted environments, persistence through Windows Run keys, string obfuscation, and regsvr32.exe abuse to load OCX files from user-writable locations.
Defenders should restrict pasted-command execution where practical, block regsvr32.exe from loading OCX files from user-writable folders, and alert on suspicious Run key entries. Organizations should also investigate Chrome or Edge processes launched with remote-debugging options, monitor unusual WebSocket traffic, enforce phishing-resistant multifactor authentication, and limit administrator privileges between workstations.
Source: Cybersecurity News