12 minhigh
TAG-195 Upgrades MaaS Ecosystem with Modular Tools
Insikt Group documents four new TAG-195 (Golden Chickens) malware families — TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator — representing an architectural shift from monolithic implants toward a controller-and-plugin model that loads capability modules on demand from C2. All variants share consistent evasion techniques (filename execution gating, OCX/regsvr32.exe execution, WebSocket JSON C2, and identical Run key persistence), and the ecosystem now includes a Chrome App-Bound Encryption bypass helper and live Chrome DevTools Protocol session hijacking, closing previously identified capability gaps in the group's tooling.
Sens:▲ 24hConf:
Showing defanged values
- domainahdaratlegalservices[.]comClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructure
- domainaurekh[.]comClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructure
- domainpaysolutions[.]inkClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructure
- domainscreenly[.]camClickFix lure webpage used by TAG-127 to induce victims to copy/paste malicious commands leading to TinyEgg installation
- domainthessa[.]trackgrid[.]netPayload staging and WebSocket C2 domain used in the current TAG-195 campaign
- domainxtrafftrck[.]netDedicated domain used for OCX payload staging and WebSocket command-and-control across TinyEgg/ChonkyChicken infections
- filenamechromelevator.ocxAttacker-modified Chrome App-Bound Encryption bypass helper (ChromEggscalator) staged and executed via regsvr32.exe
- filenamekoki.ocxAttacker-created Modular ChonkyChicken controller implant filename required to pass execution gating checks
- ip108[.]61[.]209[.]100Payload staging and WebSocket C2 infrastructure
- ip65[.]20[.]102[.]161Payload staging and WebSocket C2 infrastructure
- ip65[.]20[.]105[.]177Payload staging and WebSocket C2 infrastructure
- ip70[.]34[.]205[.]43Shared hosting IP consolidating four TAG-195/TAG-127 ClickFix lure domains
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinComCtlRun key value created by TinyEgg/ChonkyChicken for persistence, pointing to the staged OCX payload
- sha256
- sha25616735cb80d796865b2430aa11d21a539fcb00b027932f2c63e4b5c098d26585bModular ChonkyChicken sample
- sha25633a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87dChromEggscalator sample
- sha2565d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834cChonkyChicken sample referenced by YARA rule
- sha256
- sha2569a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826ChonkyChicken sample
- sha256b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45ChromEggscalator sample
- sha256d5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1bChonkyChicken sample
- sha256e3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581Modular ChonkyChicken sample
- sha256
Detection / HunterAnthropic
What Happened
Security researchers found that a criminal group known as 'Golden Chickens' has upgraded its hacking toolkit-for-hire, which other criminal gangs rent and use to break into computers. The new tools are designed to be harder for security software to detect because they only download extra capabilities (like password theft or spying features) after the initial break-in succeeds, rather than including everything upfront. Anyone using a Windows computer could be affected, since the attackers trick victims into copying and pasting a command into their computer's 'Run' box after being shown a fake security-check webpage (a technique called ClickFix). This matters because the stolen data can include browser-saved passwords and even live access to logged-in accounts (like email or banking), which simply changing your password afterward would not stop. People and organizations should be cautious about following instructions from unexpected webpages that ask them to copy/paste commands, and IT teams should consider restricting this Run dialog feature and monitoring for the technical indicators listed in the report.
Key Takeaways
- TAG-195 (Golden Chickens/Venom Spider) released four new malware families — TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator — reflecting a deliberate shift to a modular, operator-driven MaaS architecture.
- Modular ChonkyChicken uses a controller-and-plugin design that requests at least 14 capability modules on demand from C2, keeping the base implant's static footprint minimal and its capabilities undetectable from the controller alone.
- All four families share consistent evasion/architecture traits: filename gating checks, OCX packaging executed via regsvr32.exe, WebSocket JSON C2 protocol, and identical Run key persistence (WinComCtl), indicating a single coherent development framework.
- ChromEggscalator, a modified version of the public tool ChromElevator, closes a previously identified capability gap by bypassing Chrome App-Bound Encryption (ABE) to steal browser credentials.
- ChonkyChicken supports live Chrome DevTools Protocol (CDP) session hijacking, allowing operators to control an authenticated browser session in real time — a capability that survives password resets and is not addressed by credential rotation alone.
- TAG-127 has been directly observed deploying TinyEgg via ClickFix-style fake CAPTCHA/verification pages that trick victims into pasting and executing malicious commands via the Windows Run dialog.
Affected Systems
- Windows 10/11 endpoints (regsvr32.exe-capable systems)
- Google Chrome and Microsoft Edge browsers (credential store and CDP-enabled sessions)
- Enterprise Active Directory / domain-joined environments (targeted by network and domain reconnaissance modules)
- End users susceptible to ClickFix-style social engineering
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim visits a ClickFix-style fake CAPTCHA/verification lure page (e.g., screenly[.]cam) and is instructed to paste a command into the Windows Run dialog
- Execution: The pasted command downloads an OCX payload from staging infrastructure and executes it via the legitimate regsvr32.exe utility, installing TinyEgg
- C2 & Registration: TinyEgg establishes a WebSocket connection to attacker infrastructure and registers the host (hostname, user, OS, privilege level)
- Persistence: TinyEgg or ChonkyChicken stages the OCX to a user-writable directory and creates a Run key (WinComCtl) for logon persistence
- Second-Stage Deployment: Operators instruct TinyEgg to download and execute ChonkyChicken (or Modular ChonkyChicken, which loads additional plugins on demand) for expanded post-exploitation capability
- Collection & Lateral Movement: ChonkyChicken performs browser credential theft (via ChromEggscalator), CDP browser session hijacking, keylogging, network/domain reconnaissance, and credential-backed lateral movement, exfiltrating data over the WebSocket C2 channel
Detection Availability
- YARA Rules: Yes
- Sigma Rules: Yes
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Recorded Future Insikt Group, Sigma, YARA
The article includes Sigma rules for ChonkyChicken lg.txt temp file creation (Appendix C) and ChromEggscalator execution via regsvr32 (Appendix D), plus a YARA rule targeting ChonkyChicken string artifacts (Appendix E). Recorded Future customers can also access broader Hunting Packages and intelligence-driven detections referenced in the Mitigations section.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Execution occurs via regsvr32.exe loading OCX files from user-writable directories and Run key creation, both of which are visible to EDR process/registry telemetry, but the modular controller design means capability-specific behaviors (e.g., specific plugin functions) may not be visible if the module is never dropped to disk or loaded only in memory. |
| Network Visibility | Low | C2 relies on WebSocket connections with RFC 6455 frame masking, which defeats content-based network signatures without prior frame decoding; detection instead depends on behavioral/metadata signals such as destination, port, and endpoint path patterns. |
| Detection Difficulty | Moderate | Individual behavioral indicators (filename gating artifacts, Run key value, log files) are well-documented and consistent across the tool family, making signature-based detection of known indicators straightforward; however, the modular controller's on-demand plugin loading and WebSocket frame masking make network-based and capability-specific detection considerably harder without prior visibility into module content. |
Required Log Sources
- Windows Sysmon/EDR process creation logs (Event ID 1) for regsvr32.exe invocations
- File creation events (Sysmon Event ID 11) for OCX files and log artifacts (lg.txt, xlog.txt)
- Registry modification events (Sysmon Event ID 13) for Run key creation under HKCU...\Run\WinComCtl
- Network/proxy logs capturing outbound WebSocket connections and non-standard destination ports (e.g., 3000)
- Browser process creation logs for Chrome/Edge launched with --remote-debugging-port arguments
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for regsvr32.exe loading .ocx or .dll files from user-writable paths such as %TEMP%, %APPDATA%, %LOCALAPPDATA%\Packages, or Downloads folders, which is atypical for legitimate COM registration workflows (T1218.010). | EDR process creation logs, command-line arguments | Execution / Defense Evasion | Medium — some legitimate software installers use regsvr32 for COM registration, though rarely from these specific user-writable locations |
| Hunt for creation of a Run key value named 'WinComCtl' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, which is consistently used across TinyEgg and ChonkyChicken for persistence (T1547.001). | Registry modification events, EDR persistence telemetry | Persistence | Low — this specific value name is not a standard Windows or common third-party naming convention |
| Consider hunting for Chrome or Edge processes launched with remote-debugging-port arguments combined with off-screen window-position flags, indicating possible CDP session hijacking (T1528). | Process creation command-line logging, EDR browser process telemetry | Collection / Credential Access | Low — legitimate use of remote debugging combined with deliberately off-screen positioning is uncommon in enterprise environments |
| Investigate for creation of debug/log artifacts named lg.txt in %TEMP% or xlog.txt in C:\ProgramData, which the malware family reliably writes during execution-gating checks and credential extraction (T1074.001). | File creation events, EDR file monitoring | Execution | Low — these specific filenames and paths are not commonly used by legitimate software |
| Consider monitoring for sustained outbound WebSocket connections to non-standard ports (e.g., 3000) or consistent endpoint paths like /ws/agent, which may indicate task-driven C2 communication (T1071.001). | Proxy/firewall logs, network flow data, TLS SNI logging | Command and Control | Medium — legitimate applications also use WebSocket protocols, so path/port combinations should be correlated with other indicators |
Control Gaps
- Content-based network IDS/IPS signatures are largely ineffective against WebSocket C2 traffic due to mandatory RFC 6455 frame masking
- Endpoint controls that only block outright execution of regsvr32.exe would break legitimate COM registration; selective directory-based blocking is needed instead
- Capturing only the Modular ChonkyChicken controller provides no visibility into which capability modules an operator has deployed, since modules are loaded on demand and not embedded at rest
- Password/credential rotation alone does not terminate an active CDP-hijacked browser session, leaving a residual compromise path
Key Behavioral Indicators
- regsvr32.exe process ancestry originating from a web browser or a ClickFix-style Run dialog paste event
- OCX files staged in %TEMP%, %APPDATA%\Packages, or similarly atypical user-writable locations shortly before regsvr32.exe execution
- Registry Run key creation under a consistently named non-standard value (WinComCtl) pointing to an OCX file
- Presence of debug log files with fixed names (lg.txt, xlog.txt) in temp/ProgramData directories
- Browser processes launched with remote-debugging flags combined with off-screen window coordinates
- Outbound WebSocket handshakes to non-standard ports with consistent URI path structures
False Positive Assessment
Medium — behavioral indicators like Run key value names, specific log filenames, and OCX staging paths are highly reliable with low false-positive risk, but broader detections such as regsvr32.exe execution from user directories or WebSocket traffic on non-standard ports may require tuning to avoid flagging legitimate software installers or applications.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting: consider restricting or disabling the Windows Run dialog via Group Policy where operationally feasible to reduce ClickFix-style manual execution risk.
- Consider enforcing PowerShell Constrained Language Mode for standard users and blocking execution of unsigned scripts to limit available command types for ClickFix payloads.
- If your EDR or application control tooling supports it, evaluate blocking regsvr32.exe from loading .dll/.ocx files from user-writable directories (%TEMP%, %APPDATA%, %LOCALAPPDATA%, Downloads, browser cache paths).
- Consider alerting on or blocking cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, and regsvr32.exe when spawned from web-delivered or email-delivered workflows, subject to validation in your environment.
Infrastructure Hardening
- Evaluate routing workstation web traffic through authenticated proxies and denying direct outbound traffic to non-standard ports, including blocking outbound port 3000 unless explicitly required.
- Where technically and legally permissible, consider implementing WebSocket frame decoding in network inspection tooling to enable behavioral detection of masked C2 traffic.
- Consider restricting direct-to-IP HTTP/HTTPS traffic at the perimeter to reduce reachability of attacker infrastructure independent of domain-based blocking.
- Evaluate deploying Windows LAPS and rotating local administrator credentials regularly to reduce the value of credentials obtained via browser theft or keylogging.
- Consider restricting schtasks /s, WinRM, SMB administrative shares, and RDP between workstations where not operationally required.
User Protection
- Consider removing local administrator rights from standard user accounts and enforcing least-privilege principles.
- Evaluate disabling browser-based password storage where feasible and migrating users to an enterprise password manager.
- Consider enforcing FIDO2 or phishing-resistant MFA for high-value applications to reduce impact of credential theft even if ABE bypass succeeds.
- If your EDR supports it, consider alerting on Chrome/Edge processes launched with --remote-debugging-port arguments, particularly combined with off-screen window positioning.
Security Awareness
- Consider incorporating ClickFix awareness training that specifically warns users against pasting and executing commands from webpages, even those appearing to be security/CAPTCHA verification prompts.
- Evaluate running purple-team exercises emulating the non-malicious elements of the TAG-195 infection chain (ClickFix prompts, regsvr32 loading a benign OCX, Run key creation, browser remote-debugging launches) to validate detection coverage.
- Consider reinforcing that resetting passwords after a suspected incident does not address active browser session hijacking (CDP), and investigate independently.
- Evaluate maintaining threat intelligence watchlists for TAG-195 infrastructure, lure domains, and payload hashes to support timely detection of new campaign activity.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping24 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Domains:
aurekh[.]com- ClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructureahdaratlegalservices[.]com- ClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructurepaysolutions[.]ink- ClickFix lure domain hosted on shared TAG-195/TAG-127 infrastructure
- File Hashes:
b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45(SHA256) - ChromEggscalator sample33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d(SHA256) - ChromEggscalator sample086273cd91f3d6556ed2af915df310e4b184b3db84c3903aa09830d49d1fbb62(SHA256) - TinyEgg sample652346c05123b4c9556c27f5c5efc4bcd941dd66957e3797c6751246a2bff9c6(SHA256) - TinyEgg samplef3f4de7eb30c01044ad3c7f2c22376d0ab6f6dc60ef6aee3cde75fd33fbddacc(SHA256) - TinyEgg sample5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c(SHA256) - ChonkyChicken sample referenced by YARA rule9a2d714ddd5c48722c35df8a70e97f12d46bcde05dc79b7242a7e692bd346826(SHA256) - ChonkyChicken sampled5dea9a51b984be9d7fa76e3e8ff89cfb97c335927331e8e348b9ee269070c1b(SHA256) - ChonkyChicken samplee3153ced59bb0376186b0eee0ec68f0b5aa9ae5820ef8508ae4e67625e1a3581(SHA256) - Modular ChonkyChicken sample16735cb80d796865b2430aa11d21a539fcb00b027932f2c63e4b5c098d26585b(SHA256) - Modular ChonkyChicken sample
- File Paths:
%TEMP%\lg.txt- ChonkyChicken debug log created on execution-gating failure; reliable forensic indicator of execution attemptsC:\ProgramData\xlog.txt- ChromEggscalator operational log recording browser discovery, API resolution, and extraction activity%LOCALAPPDATA%\Packages\- Staging location for persistent OCX payloads across TinyEgg and ChonkyChicken%TEMP%\wpad_capture.ocx- WPAD helper OCX staged and loaded by ChonkyChicken/Modular ChonkyChicken for network interception%TEMP%\mscom.ocx- Browser credential-theft helper staged by ChonkyChicken%TEMP%\output\- Output directory where ChromEggscalator writes extracted credential hashes for ChonkyChicken collection
- Command Lines:
- Purpose: Execute a staged malicious OCX payload to install/run TinyEgg, ChonkyChicken, or ChromEggscalator | Tools:
regsvr32.exe| Stage: Execution |regsvr32.exe /s %TEMP%\<staged_file>.ocx
- Purpose: Execute a staged malicious OCX payload to install/run TinyEgg, ChonkyChicken, or ChromEggscalator | Tools:
- Other:
ws://localhost:3000/ws/agent- Observed WebSocket C2 endpoint in a Modular ChonkyChicken sample using localhost, indicating a development/testing configuration
