Insikt Group (Recorded Future) details four new malware families attributed to TAG-195, a Malware-as-a-Service (MaaS) operator: TinyEgg, ChonkyChicken, Modular ChonkyChicken, and ChromEggscalator. The report covers the full attack chain starting with ClickFix-style delivery via regsvr32-loaded OCX payloads, WebSocket-based C2 on port 3000, Run key persistence under WinComCtl, browser credential theft bypassing Chrome App-Bound Encryption via CDP automation, and extensive lateral movement capabilities. The architectural shift to a modular controller design means captured implants reveal no operational capability at rest, complicating forensic analysis. Defenders are advised to block regsvr32 loading from user-writable directories, monitor for Chrome remote debugging arguments, restrict outbound port 3000, and deploy LAPS. The report includes full IoCs, YARA rules, Sigma detection rules, and a MITRE ATT&CK technique mapping.
