You would think that getting caught in the spotlight would make a cybercriminal group pack up and disappear. But with the Golden Chickens malware-as-a-service crew, the opposite seems to be happening. Despite researchers shining a bright light on their operations, these operators are still actively developing new tools and they have just released four fresh malware families into the wild.
The Golden Chickens malware MaaS ecosystem is not slowing down. In fact, it is evolving. Recorded Future's Insikt Group is tracking the developers behind this operation under the name TAG-195, and they are watching closely as the group rolls out some significant architectural changes.
Who Exactly Are These Players?
TAG-195 is a financially motivated operation that builds and sells malware to other cybercriminal groups. Think of them as the suppliers in a shady supply chain. One of their known customers is TAG-127, a group that takes these tools and runs real-world attacks. The relationship is simple: TAG-195 builds, TAG-127 deploys.
What makes this particularly concerning is the delivery method. TAG-127 has been using ClickFix-style social engineering campaigns to push a new backdoor called TinyEgg. In case you do not know what ClickFix is, it is basically an ingenious way that attackers have devised to trick the user into copying and pasting their command. The user thinks they are fixing a problem or installing a routine update. In reality, they are handing over the keys to their machine.
Meet the Four New Families
The fact that Golden Chickens has rolled out four new tools is noteworthy. But what is really interesting is the strategy behind them. The group is shifting toward a modular approach. Rather than having everything packaged in one large piece of malware, they have been dividing things into smaller and on-demand pieces of malware.
TinyEgg: The Lightweight Gatekeeper
TinyEgg was built with being lightweight, fast, and stealthy in mind. Its job is not to do everything, it is to get a foot in the door. Once installed, it profiles the compromised host, provides interactive shell access, and manages persistence so the connection stays alive.
But here is the clever part: TinyEgg actively checks whether it is running in a sandbox or a virtualized analysis environment. If it detects that it is being studied, it simply shuts down. This anti-analysis feature makes life significantly harder for researchers trying to understand how it works.
ChonkyChicken: The Heavy Hitter
If TinyEgg is the scout, ChonkyChicken is the invasion force. This fully featured implant takes everything TinyEgg can do and expands it significantly. We are talking about browser credential theft, the ability to hijack live browser sessions through Chrome DevTools Protocol, remote execution with stolen credentials, network scanning, and persistent surveillance.
The live session hijacking piece is especially dangerous. Through hijacking an ongoing session, it is possible for the attacker to bypass MFA since the attacker is actually using the legitimate user's authenticated session, making it extremely difficult for him/her to be detected.
Modular ChonkyChicken: Smarter and Leaner
Here’s where the fun starts. The Golden Chickens malware MaaS crew has developed a modular version of ChonkyChicken that changes the game entirely. Instead of shipping one massive implant with every possible feature baked in, this version uses a controller-and-plugin setup. The malware communicates with the command-and-control server and downloads just those modules that it requires at any particular time.
Why does this matter? Because the base implant stays small and hard to detect. Signature-based security tools have less to sink their teeth into. And if one customer gets compromised, the full toolkit is not exposed, the attackers can limit the damage.
This modular version comes with 14 capability modules, covering everything from process management and screen capture to keylogging, audio capture, and browser credential theft. There is even a mysterious module called "wtrack" that researchers have not fully decoded yet. That suggests the Golden Chickens malware MaaS team is still building out new capabilities behind the scenes.
ChromEggscalator: The Credential Grabber
Rounding out the four is ChromEggscalator, a tool that steals credentials from Chrome browsers. This is actually a modified version of an open-source tool called ChromElevator, which bypasses Chrome's encryption to extract saved passwords. Through modifying code that has already been written, the team behind Golden Chickens is able to be more efficient and productive.
Sequence of Attack Chain
Let us look at one example of how the attack happens. The attacker will first present his ClickFix exploit to the victim, either via a fake error message or popup from technical support. The victim is then asked to paste some command in their terminal or PowerShell console. They do it, believing they are resolving an issue.
That command reaches out to an attacker-controlled server and pulls down an OCX payload. That payload installs TinyEgg. TinyEgg checks the environment to make sure it is not being analyzed. If it is safe, it establishes a persistent connection and then pulls down ChonkyChicken or its modular variant to handle the post-exploitation work. The entire process is streamlined and surgical.
This Is Not a New Player
The Golden Chickens malware MaaS operation, also known as Venom Spider, has been around for a while. The group is associated with the More_eggs malware family, and its tools have been used by some major players in the cybercrime world, including Cobalt Group, Evilnum, and FIN6. These are not small-time operators. They are established, professional, and well-resourced.
What the modular shift tells us is that the Golden Chickens malware MaaS developers are thinking commercially. They want to offer different levels of capability to different customers. They want to protect their intellectual property. And they want to stay under the radar for as long as possible. All of that makes good business sense, unfortunately for the rest of us.
What Should You Do About It?
If you are in charge of security for an organization, this news should prompt a few conversations. Signature-based detection is not going to cut it against modular malware that fetches components on demand. You need behavioral monitoring. You need endpoint detection and response tools that look for suspicious patterns rather than known signatures.
But equally important is user education. ClickFix campaigns are effective because they prey on human behavior. People want to solve problems quickly, and if a convincing prompt tells them to copy and paste a command, many will do it without a second thought. Regular training sessions that simulate these attacks can make a real difference.
Wrapping It Up
The resurgence of the Golden Chickens malware MaaS ecosystem with four new families is a reminder that cybercriminals do not quit just because they have been exposed. They adapt. They innovate. But they just keep on building.
The trend towards modular design is a big step forward, both for Golden Chickens and for the security threat world as a whole. Others will almost certainly do the same thing. It is important to understand that defending against threats in the past way won’t work anymore.
For now, the Golden Chickens malware MaaS operators are still in the game and they are playing smarter than ever.
FAQ Section
What is the Golden Chickens malware MaaS ecosystem?
It is a malware-as-a-service operation run by financially motivated developers tracked as TAG-195. They build and sell cyberattack tools to other criminal groups, including Cobalt Group, Evilnum, and FIN6.
How does ClickFix trick people into installing malware?
ClickFix uses social engineering to convince users to manually copy and paste malicious commands into their own terminals. The user believes they are fixing a problem, but they are actually executing code that installs malware.
What makes modular malware harder to detect?
Traditional malware includes all its capabilities in one big file, making it easier for security tools to recognize. Modular malware keeps the core implant small and fetches additional components only when needed, leaving a much smaller footprint for detection tools to catch.
Who else has been found to be utilizing Golden Chickens’ tools?
It can be stated that TAG-127 has been confirmed to be one of the users and operators of the platform. Some other operators have also been found to be Cobalt Group, Evilnum, and FIN6. The platform operates commercially, so there may be additional customers not yet identified.
What can be done to protect against such threats?
There must be an adoption of behavior-based detection, endpoint protection and detection, and proper user training for identifying social engineering. Depending only on signature-based antivirus software won’t work anymore.
