ChonkyChicken Malware Steals Chrome Credentials and Spies on Victims

Key Takeaways

• ChonkyChicken is a newly discovered remote access trojan (RAT) that enables extensive credential theft, network lateral movement, and victim surveillance on Windows systems.
• The malware is part of the TAG-195 (also known as Golden Chickens or Venom Spider) malware-as-a-service (MaaS) ecosystem, which provides sophisticated tools to financially motivated cybercriminals.
• Initial infections often leverage “ClickFix” lures, tricking users into executing commands that deploy the TinyEgg backdoor, followed by ChonkyChicken.
• ChonkyChicken employs a specialized helper, ChromEggscalator, to bypass Chrome’s App-Bound Encryption and steal browser secrets, including credentials and active session tokens.
• Its advanced capabilities allow attackers to control live browser sessions, map internal networks, and maintain persistent surveillance, making it a significant threat beyond simple password theft.

ChonkyChicken: A New Threat in the MaaS Landscape

A sophisticated remote access trojan (RAT) dubbed ChonkyChicken has emerged, transforming compromised Windows devices into potent platforms for credential harvesting, internal network navigation, and continuous espionage. This new malware is a key component of the TAG-195 collective, also identified as Golden Chickens or Venom Spider, a prominent malware-as-a-service (MaaS) provider catering to financially driven threat actors.

Initial Compromise and Payload Delivery

Recent attack campaigns initiating ChonkyChicken infections utilize deceptive “ClickFix” lures. These are fraudulent verification pages designed to trick unsuspecting users into pasting a malicious command directly into the Windows Run dialog box. This seemingly innocuous action triggers the download and execution of an OCX payload via `regsvr32.exe`. This initial stage establishes the TinyEgg backdoor, securing preliminary access before the full ChonkyChicken payload is deployed. This technique, where the victim is manipulated into initiating the critical infection step, highlights a concerning trend in attack methodologies.

Analysts at Recorded Future’s Insikt Group first identified ChonkyChicken during their ongoing monitoring of the evolving TAG-195 ecosystem. According to a Recorded Future report, ChonkyChicken functions as a second-stage implant, consolidating a wide array of malicious capabilities including browser data theft, interactive session control, remote execution, reconnaissance, and persistent monitoring into a single framework.

The implications of ChonkyChicken extend far beyond simple password theft. Attackers can leverage stolen browser data and active sessions to gain unauthorized access to business services, meticulously map internal systems, and move laterally across an organization’s network to compromise additional devices. This threat underscores the critical need for organizations to proactively monitor for browser-stored credential theft, rather than underestimating the risks associated with saved passwords.

ChonkyChicken Malware Capabilities

At the core of ChonkyChicken’s credential theft capabilities is a specialized helper module named ChromEggscalator. This component is specifically engineered to circumvent Chrome’s App-Bound Encryption protections, enabling the extraction of sensitive browser secrets. Once downloaded and placed in a temporary directory, ChromEggscalator is executed via a Windows utility, with the collected credential data subsequently exfiltrated to the attacker’s command-and-control server.

Beyond credential extraction, ChonkyChicken possesses the ability to control live Chrome or Edge browser sessions through the Chrome DevTools Protocol automation. It achieves this by launching a browser instance invisibly with remote debugging enabled, granting operators direct interaction with already authenticated sessions. This means that even after a password reset, an attacker might retain access if they still control an active browser session.

The malware also facilitates extensive lateral movement within a compromised network. ChonkyChicken can exploit existing credentials or access tokens, identify logged-in sessions without triggering authentication events, create remote scheduled tasks, perform port scanning, discover network hosts, and pinpoint accessible network shares. This comprehensive suite of features elevates ChonkyChicken beyond typical password stealers, positioning it as a tool designed for in-depth network infiltration and persistent compromise. The risks presented are akin to those seen in browser extension credential theft, where deep browser access can expose both stored credentials and active user accounts.

Modular Spying and Defense Evasion

ChonkyChicken’s surveillance capabilities are extensive, including the collection of keystrokes, clipboard contents, audio recordings, and screenshots, providing attackers with continuous insight into victim activities. A modular variant of the malware can dynamically request at least 14 different capability plugins only when required, thereby minimizing the initial malicious footprint on a compromised device and making detection more challenging.

All malware families associated with TAG-195 share common tactics aimed at evading detection. These include performing filename checks to avoid execution in unwanted environments, establishing persistence through Windows Run keys, obfuscating strings, and abusing `regsvr32.exe` to load OCX files from user-writable locations. Security teams should be particularly vigilant for `regsvr32` abuse, especially when it involves files residing in `TEMP` or `AppData` directories.

What You Should Do

• **Restrict Command Execution:** Where technically feasible, implement policies to restrict or prevent the execution of pasted commands, particularly in administrative or elevated contexts.
• **Monitor `regsvr32.exe` Usage:** Configure security tools to block `regsvr32.exe` from loading OCX files from user-writable directories (e.g., `TEMP`, `AppData`).
• **Audit Run Key Entries:** Regularly review and alert on suspicious entries in Windows Run keys, which are often used for malware persistence.
• **Investigate Browser Processes:** Monitor for Chrome or Edge browser processes launched with remote-debugging options, as this is a key indicator of ChonkyChicken’s active session control.
• **Monitor WebSocket Traffic:** Implement network monitoring to detect unusual WebSocket traffic, which could indicate active communication channels for malware.
• **Enforce Phishing-Resistant MFA:** Deploy and enforce phishing-resistant multi-factor authentication (MFA) across all critical accounts to mitigate the impact of stolen credentials.
• **Limit Administrator Privileges:** Implement strict least-privilege principles, limiting administrator privileges between workstations to restrict lateral movement.
• **Review Indicators of Compromise (IoCs):** Integrate the provided IoCs into your security information and event management (SIEM) and endpoint detection and response (EDR) systems for proactive threat hunting and detection.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.