Golden Chickens Resurfaces: Four New Families, Same MaaS

Recorded Future’s Insikt Group published research today documenting four new malware families from Golden Chickens (also called Venom Spider, tracked as TAG-195) — a financially-motivated malware-as-a-service operation whose customers include Cobalt Group, FIN6, and Evilnum. The group has been publicly documented for years. The research confirms it’s still actively developing tooling despite sustained disclosure. The Hacker News has the full summary.

The four families:

TinyEgg is the initial-access implant: lightweight, profiles the host, drops a persistent interactive shell. It terminates when it detects a sandbox or automated analysis environment. Static detonation alone won’t catch it in your pipeline.

ChonkyChicken is the full-featured follow-on: browser credential theft, live Chrome DevTools Protocol (CDP) session control, credential-backed remote execution, and network reconnaissance. The CDP capability is worth isolating — most enterprise environments have almost no visibility into process-to-process CDP sessions, and very few legitimate use cases for them. If you’re not querying for it, you’re not seeing it.

Modular ChonkyChicken is a refactored variant with a controller-and-plugin architecture. It fetches 14 discrete capability modules on demand instead of bundling everything at load time: process management, screen capture, file manipulation, command execution, network and domain reconnaissance, clipboard and keylogging, audio capture, idle-time checks, HTTP/S proxy requests, persistence management, browser credential theft via ChromEggscalator, and a “wtrack” module Insikt Group hasn’t fully characterized yet. Pulling modules on demand reduces the static footprint at any given point in an infection — a single static signature covering the full toolkit doesn’t exist.

ChromEggscalator replaces TerraStealerV2 as the credential extraction component. It’s a modified version of ChromElevator, a public tool for bypassing Chrome’s encryption of stored credentials.

Delivery and C2:

The documented delivery chain runs through ClickFix lures that execute OCX payloads — TAG-127, a Golden Chickens operator and customer, uses this alongside VenomLNK. C2 runs over WebSockets for interactive command shells. Across all four families, Insikt Group found consistent C2 mechanisms, shared persistence approach, and string obfuscation as the common thread.

The pattern:

Golden Chickens has been exposed before — prior tooling including TerraStealerV2 and earlier implants has been publicly documented. The response has been consistent: retool and continue. The shift toward on-demand modular architecture in this generation is the most significant design change for evasion, and it’s a direct response to static detection. The group operates as a service. The customers keep coming.

What to actually do

If you’re seeing FIN6, Cobalt Group, or Evilnum TTPs in your environment, this toolkit is now in their potential arsenal. Insikt Group’s research is public; your threat intel team should have the C2 indicators from the report.

Detection priorities:

1. Flag CDP abuse. Chrome DevTools Protocol sessions initiated by non-browser processes are unusual. Most endpoint telemetry has the data — it just isn’t queried by default. Write the query, run it, set an alert.

2. Don’t rely solely on sandbox detonation for TinyEgg. It terminates in automated analysis environments. You need behavioral detections in production telemetry, not just detonation results.

3. Hunt OCX payload execution. ClickFix social engineering is the delivery method. OCX payloads executed via regsvr32 or mshta from user-writable directories are worth a dedicated hunt rule if you don’t already have one.

4. Pull the Insikt Group IOCs. C2 indicators and WebSocket endpoint patterns are in the report. Your detection stack should have them.

5. Audit browser-managed credentials. ChromEggscalator exists because credentials are in browsers. Privileged accounts should not be authenticating out of browser-stored passwords. That’s not a new problem — Golden Chickens is just the current reminder.

The modular architecture is the key operational change here. It means detection investment needs to shift toward behaviors — ClickFix delivery chains, CDP misuse, WebSocket C2, OCX execution via scripting hosts — not toward static signatures for a toolkit that’s designed to never look the same twice.