Do Son 
Recent TAG-195 ClickFix infection (Source: Recorded Future)
At a glance
| Actor or group | TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed by an operator tracked as TAG-127 |
| Activity type | Malware-as-a-service development; credential theft, remote access, and network reconnaissance tooling |
| Targets or victims | Windows users in enterprise environments; no named victims disclosed |
| Scale | Four malware families and at least fourteen plugin modules; no victim count or loss figure published |
| Law-enforcement status | No charges, arrests, or takedowns announced |
| Source | Insikt Group (Recorded Future) |
TL;DR
Insikt Group has named four new Golden Chickens malware families in a report dated 23 July 2026. The set covers TinyEgg, ChonkyChicken, a plugin-based ChonkyChicken variant, and a browser credential helper called ChromEggscalator. Taken together, they point to a shift toward modular tooling that operators can assemble per intrusion.
What happened
Recorded Future’s research arm tracks this developer as TAG-195. Analysts found the four families while monitoring the group’s malware-as-a-service ecosystem. All four share the same build habits, which suggests a single development team rather than unrelated tools.
How the infection starts
Delivery runs through ClickFix pages. Victims land on a fake security check that imitates a CAPTCHA prompt. The page tells them to open the Windows Run dialog and paste a command already sitting in their clipboard. That command pulls an OCX payload from staging infrastructure, then runs it through a legitimate Windows binary.
Insikt Group observed an operator it tracks as TAG-127 using this method. Because the victim types the command themselves, email filters and attachment scanners never see a file.
What the implants do
TinyEgg lands first and stays small. It profiles the host, opens an interactive shell, and manages startup persistence. That is all it does. On operator instruction, it then fetches ChonkyChicken.
ChonkyChicken carries the weight. It steals browser credentials, drives live browser sessions over Chrome DevTools Protocol, scans the local network, and records keystrokes, clipboard text, audio, and screen frames. One detail deserves attention: an operator with a live browser session can act as the signed-in user. Resetting passwords afterwards does not close that session.
ChromEggscalator handles the hard part of credential theft. TAG-195 took ChromElevator, an open-source Chrome App-Bound Encryption bypass tool, and reworked it into a quiet helper. That closes a gap Insikt Group flagged in its April 2025 reporting on earlier tooling.
The plugin system
Modular ChonkyChicken is the real change here. A small controller handles registration, tasking, and module lifecycle. Capabilities arrive from attacker infrastructure on demand, and at least fourteen modules exist. Insikt Group frames the design goal as a plan to “deploy only what each intrusion requires”.
That design hurts defenders in a specific way. A captured controller holds no capability at rest, so it reveals little about what an operator actually ran.
Who is behind it
Golden Chickens is a financially motivated malware developer rather than an intrusion crew. It supplies tooling to other criminal operators. Attribution here rests on vendor research, and no charges, arrests, or indictments have been announced against anyone linked to the group.
eSentire has previously connected Golden Chickens tooling to FIN6, Cobalt Group, and Evilnum. Arctic Wolf, reporting separately on the actor’s pivot toward recruiters, called the change “a tactical step up in terms of targeting”. None of these links has been tested in court, so read them as research assessments rather than proven facts.
Impact and scale
Insikt Group published no victim count and no loss figure. Any dollar totals circulating for Golden Chickens malware activity are claims, not confirmed damages. The report does list lure domains, staging addresses, sample hashes, two Sigma rules, and a YARA rule across its appendices.
Reach matters more than raw numbers here. A service provider supplies many unrelated operators, so a single toolkit upgrade lifts several campaigns at once.
What comes next
Insikt Group expects continued iteration on the ecosystem. One module, named wtrack, has a purpose analysts could not determine, which hints at something still in development. A localhost C2 address in the modular sample also suggests an early build rather than a finished product.
How to stay protected
Focus on the delivery step and on host artifacts, since network signatures fare poorly against masked WebSocket traffic.
- Restrict the Windows Run dialog through Group Policy where that is practical
- Block regsvr32.exe from loading OCX or DLL files out of user-writable folders
- Watch for Run key values under HKCU that point at OCX files in those folders
- Alert on Chrome or Edge launched with remote debugging flags or off-screen window positions
- Check for lg.txt in the user temp folder and xlog.txt under ProgramData
- Investigate active browser debugging sessions separately from any password reset
Indicators, detection rules, and the full technical breakdown sit in the Insikt Group report on the TAG-195 MaaS ecosystem. Security teams that have seen ClickFix prompts on their estate should treat that as reason enough to hunt now.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
