ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims

Cybersecuritynews •Tushar Subhra Dutta • July 24, 2026

ChonkyChicken is a newly identified remote access trojan designed to turn one infected Windows device into a platform for credential theft, network movement, and surveillance. The malware is part of the TAG-195, also called Golden Chickens or Venom Spider, malware-as-a-service ecosystem, which supplies tooling to financially motivated criminal operators. Recent campaigns begin with ClickFix lures, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Golden Chickens Unveils Four New Modular Malware Families Targeting Chrome Credentials TAG-195, also known as Golden Chickens or Venom Spider, has launched four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These families are designed to enhance credential theft and browser session hijacking capabilities. The malware utilizes ClickFix-style lures to trick victims into executing malicious commands. TinyEgg serves as a lightweight backdoor, while ChonkyChicken expands functionality to include browser credential theft and network reconnaissance. The modular architecture allows for selective provisioning of capabilities, reducing detection risks. Insikt Group has linked TAG-195 to previous operations and warns defenders to prioritize detection of specific execution chains and unusual communications. The malware primarily targets Windows systems. 5 sources 68

Extracted Entities

ChonkyChicken Malware Steals Chrome Credentials, Moves Laterally and Spies on Victims

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (1)

Platforms (1)