TinyEgg/ChonkyChicken OCX execution via regsvr32.exe signed-binary proxy

Ethan Andrews@eandrews

•updated Jul 24, 2026•2•0•5

Detects the execution of specific OCX files (updater.ocx, chromelevator.ocx, mscom.ocx, koki.ocx, or agent.ocx) using regsvr32.exe from user-writable directories like Temp or AppData, a behavior associated with the TinyEgg/ChonkyChicken/ChromEggscalator malware families.