The Golden Chickens malware-as-a-service (MaaS) group, tracked as TAG-195, has introduced four new malware families — TinyEgg, ChonkyChicken, a modular ChonkyChicken variant, and ChromEggscalator — signalling an active evolution of their criminal toolkit. The new families share common architectural traits and represent a deliberate shift toward modular, plugin-based design, allowing operators to selectively deploy capabilities on demand, reducing detection risk and increasing operational flexibility. This transition reflects both technical refinement and commercial incentives within the MaaS model, with the group's tools continuing to be leveraged by other cybercrime actors such as Cobalt Group, Evilnum, and FIN6.
