ChonkyChicken, a newly discovered remote access trojan, has emerged as a significant threat to Windows devices, enabling credential theft, lateral movement, and surveillance. The malware is part of the TAG-195 ecosystem, also known as Golden Chickens or Venom Spider, which offers tools to financially motivated cybercriminals.
Initial Entry and Delivery Mechanism
Recent attacks leveraging ChonkyChicken begin with ClickFix lures, which are deceptive verification pages that trick users into executing commands in the Windows Run dialog. This method downloads an OCX payload, which is then launched using regsvr32.exe, allowing the initial TinyEgg backdoor to establish access before deploying ChonkyChicken.
Security researchers at Recorded Future’s Insikt Group discovered this malware while monitoring the evolution of the TAG-195 ecosystem. The group identified ChonkyChicken as a second-stage implant capable of browser credential theft, remote session control, execution, reconnaissance, and persistent monitoring.
Broader Implications and Threats
ChonkyChicken’s impact is extensive, going beyond password theft. The malware enables attackers to exploit browser data and active sessions to infiltrate business services, map internal networks, and compromise additional devices. This highlights the critical need for organizations to prioritize the monitoring of browser-stored credentials and not dismiss saved passwords as a low-risk convenience.
To bypass security measures like Chrome App-Bound Encryption, ChonkyChicken uses a specialized tool called ChromEggscalator to collect sensitive browser data. The harvested information is then transmitted back to the attacker, who can control live browser sessions through Chrome DevTools Protocol automation, maintaining access even if passwords are changed.
Network Movement and Defense Strategies
ChonkyChicken is adept at lateral movement, exploiting credentials or access tokens, checking logged-in sessions without triggering authentication events, and performing network reconnaissance. It can create remote tasks, scan ports, discover hosts, and identify network shares, positioning itself as more than just a basic password stealer.
To combat this threat, security teams should monitor for regsvr32 abuse, especially involving files in user-writable locations like TEMP or AppData, and restrict the execution of pasted commands where feasible. Additional measures include blocking regsvr32.exe from loading OCX files from user-writable folders and investigating any Chrome or Edge processes initiated with remote-debugging options.
Modular Capabilities and Recommendations
ChonkyChicken also features modular spying capabilities, collecting keystrokes, clipboard contents, audio, and screenshots to maintain visibility into victim activities. A modular version can request additional capability plugins as needed, minimizing the initial malicious code footprint.
All current TAG-195 malware families employ tactics to evade detection, such as filename checks to avoid execution in unwanted environments, persistence through Windows Run keys, and obscured strings. Security teams are advised to enforce phishing-resistant multifactor authentication and limit administrator privileges across workstations.
Indicators of compromise (IoCs) include specific IP addresses, domains, and file names associated with the malware’s operation. Organizations should use controlled threat intelligence platforms to investigate these IoCs and assess their own exposure to similar threats.
