TAG-195 Deploys ChonkyChicken RAT for Credential Theft

The financially motivated Malware-as-a-Service (MaaS) ecosystem known as TAG-195 (also Golden Chickens or Venom Spider) has introduced a new suite of modular malware including the ChonkyChicken Remote Access Trojan (RAT), the TinyEgg backdoor, and the ChromEggscalator credential-theft helper. The group utilizes a 'ClickFix' social engineering strategy, which tricks victims into manually executing malicious commands via the Windows Run dialog to bypass automated security controls.

Technical analysis reveals that ChonkyChicken goes beyond simple password theft by leveraging the Chrome DevTools Protocol to hijack active, authenticated browser sessions. This allows attackers to access cloud-based business services without triggering traditional credential-based alerts. The malware also features robust surveillance capabilities, network scanning for lateral movement, and modular plugins to minimize its initial footprint. Given its focus on enterprise browser session hijacking and internal reconnaissance, this campaign poses a significant risk to organizations reliant on cloud infrastructure and browser-managed credentials.