Full Report
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential
Analysis Summary
# Threat Actor: Golden Chickens (TAG-195 / Venom Spider)
## Attribution & Identity
* **Primary Identifier:** Golden Chickens
* **Aliases:** TAG-195, Venom Spider
* **Associated Groups:**
* **TAG-127:** Identified as a specific operator and customer of the Golden Chickens MaaS.
* **Known Customers:** Cobalt Group (Cobalt Gang), Evilnum, and FIN6.
* **Role:** Financially motivated Malware-as-a-Service (MaaS) developer and provider.
## Activity Summary
Recent reporting (July 2026) indicates a major resurgence of the group following an architectural shift in their MaaS ecosystem. The group has introduced four new malware families designed for modularity and defense evasion. These tools are being deployed in active campaigns, notably by the operator TAG-127, who leverages "ClickFix" social engineering to deliver initial access payloads.
## Tactics, Techniques & Procedures
* **Social Engineering:** Uses "ClickFix" style lures that trick users into manually executing malicious commands/payloads.
* **Delivery Methods:** Use of VenomLNK and OCX payloads downloaded from attacker-controlled staging infrastructure.
* **Evasion:**
* Sandboxing and automated analysis environment detection (terminates execution if detected).
* Modular architecture to reduce the forensic footprint of the initial implant.
* String obfuscation.
* **Persistence:** Shared persistence mechanisms across all four new malware families.
* **C2 Communication:** Use of WebSockets to facilitate interactive command shells.
* **Living off the Land/Browser:** Abuse of Chrome DevTools Protocol (CDP) for live browser session control.
* **Credential Theft:** Bypassing Chrome encryption to extract browser-stored credentials.
## Targeting
* **Sectors:** Generally indiscriminate (MaaS model), but historically focused on financial services and high-value corporate targets (consistent with FIN6/Cobalt Group usage).
* **Geography:** Global distribution.
* **Victims:** Not explicitly named in the article, but targets any users susceptible to ClickFix-style social engineering.
## Tools & Infrastructure
* **Malware Families:**
* **TinyEgg:** Lightweight initial-access backdoor for host profiling and interactive shell access.
* **ChonkyChicken:** Full-featured implant with CDP control and reconnaissance capabilities.
* **Modular ChonkyChicken:** A controller-plugin variant supporting 14 modules (Keylogging, Audio capture, etc.).
* **ChromEggscalator:** A successor to TerraStealerV2, based on the ChromElevator tool for bypassing Chrome encryption.
* **More_eggs:** The group's legacy signature malware.
* **Infrastructure:**
* **C2 Channels:** WebSocket-based controllers.
* **Staging:** Attacker-controlled infrastructure for OCX and module delivery.
* **URLs:** ClickFix lures and staging sites (e.g., `hxxps[:]//thehackernews[.]com/2026/07/golden-chickens-resurfaces-with-four[.]html`).
## Implications
The evolution toward a modular, plugin-based architecture (moving away from monolithic implants) signals a sophisticated effort to bypass modern EDR/XDR solutions. By delivering only the necessary functionality on-the-fly, the actors limit the amount of malicious code available for static analysis. The resurgence proves that public disclosures and doxing of MaaS masterminds have failed to dismantle their development operations.
## Mitigations
* **User Training:** Educate employees to recognize "ClickFix" lures and the danger of executing manual commands in browser-based pop-ups.
* **Endpoint Security:** Implement robust EDR policies that monitor for unauthorized use of Chrome DevTools Protocol (CDP) and unusual OCX file executions.
* **Process Monitoring:** Monitor for `cmd.exe` or `powershell.exe` being spawned by web browsers.
* **Credential Protection:** Consider hardware security keys or third-party password managers to mitigate the impact of browser credential theft utilities like ChromEggscalator.