Golden Chickens Is Back, Meaner, and Now Modular
The Golden Chickens crew hasn't taken the hint. Despite significant public exposure of their malware-as-a-service operation over the years, the group tracked by Recorded Future's Insikt Group as TAG-195 has quietly expanded their toolkit with four new malware families. Whoever said sunlight was the best disinfectant clearly hadn't met these people.
The four new additions are TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator, a browser credential-theft tool that builds on a publicly available Chrome encryption-bypass utility called ChromeElevator. Collectively, they signal a deliberate architectural shift rather than just tacking on new features to old code.
Golden Chickens, also known as Venom Spider, has been around long enough to have a fanbase of criminal customers. Groups like FIN6, Cobalt Gang, and Evilnum have all used their tooling. The More_eggs backdoor is probably their most notorious product. TAG-127, another threat actor linked to the ecosystem as both operator and client, has been observed deploying TinyEgg through ClickFix-style social engineering. That's the technique where victims are manipulated into manually running malicious commands themselves, which neatly sidesteps a lot of automated defences.
Breaking down the new tools: TinyEgg is the lightweight entry point. It handles host profiling, drops a basic interactive shell, manages persistence, and importantly, checks whether it's running inside a sandbox before doing anything interesting. If it smells analysis software, it quits. Its job is access and little else, with heavier lifting handed off to ChonkyChicken once a foothold is established.
ChonkyChicken is the full-featured implant. It adds browser credential theft, live session hijacking via Chrome's DevTools Protocol, network reconnaissance, and persistent surveillance on top of what TinyEgg provides. Command-and-control runs over WebSockets, giving operators an interactive shell with real-time output.
The modular version of ChonkyChicken is arguably the most significant development. Rather than embedding all functionality directly into the implant, it uses a controller-and-plugin architecture. The controller can pull down any of 14 discrete capability modules on demand from C2 infrastructure. Those modules cover pretty much the full post-exploitation playbook: keylogging, screen capture, audio recording, clipboard theft, file manipulation, process management, network and domain reconnaissance, and browser credential theft via ChromEggscalator. There's also a module called "wtrack" whose purpose Recorded Future hasn't been able to determine, which suggests something still being cooked.
The commercial logic here is obvious once you see it. A modular architecture means the base implant is smaller and harder for static analysis tools to flag. It also means the MaaS operators can provision capabilities selectively to different customers, contain blast radius if one operator gets caught, and adjust the offering without pushing full implant updates. It's essentially SaaS product management applied to cybercrime infrastructure.
All four families share consistent C2 mechanisms, a common persistence approach, and string obfuscation, suggesting they come from the same development pipeline rather than being stitched together from separate projects.
The takeaway is straightforward: public reporting on criminal infrastructure doesn't automatically defang it. TAG-195 has read the threat intelligence reports, noted what got exposed, and responded by building something harder to detect and more flexible to operate. That's not a particularly comforting thought.