Golden Chickens Launches Four Modular Malware Families to Steal Chrome Credentials and Hijack Browser Sessions

Golden Chickens, tracked as TAG-195 and also known as Venom Spider, has launched four new modular malware families designed to enhance credential theft, browser session hijacking, and post-exploitation flexibility.

The newly identified families TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator mark a clear architectural evolution in the group’s malware-as-a-service (MaaS) ecosystem, signaling a shift toward scalable, operator-driven tooling.

Insikt Group also observes overlap with TAG-127, a threat actor actively deploying Golden Chickens tooling in real-world campaigns.

In recent activity, TAG-127 leveraged ClickFix-style social engineering, where victims are tricked into executing malicious commands via fake CAPTCHA or verification pages.

These commands use legitimate Windows utilities such as regsvr32.exe to download and execute payloads, effectively bypassing traditional file-based detection controls.

The newly discovered TinyEgg malware operates as a lightweight initial access backdoor. Delivered as an OCX component, it establishes persistence via Windows Run keys and communicates with command-and-control (C2) infrastructure over WebSockets using a structured JSON-based protocol.

TinyEgg enables host profiling, privilege enumeration, and interactive shell access, acting as a staging implant for second-phase payload delivery.

Its constrained functionality reflects a deliberate design choice to minimize detection during early intrusion stages.

ChonkyChicken significantly expands operational capabilities and represents the primary post-exploitation implant.

It integrates browser credential theft, session hijacking via Chrome DevTools Protocol (CDP), credential-based lateral movement, and comprehensive network reconnaissance.

Notably, it enables attackers to control live browser sessions, allowing real-time interaction with authenticated environments even after password resets an increasingly common gap in incident response strategies.

A critical enhancement in this malware generation is the integration of ChromEggscalator, a modified version of the open-source ChromElevator tool.

This component bypasses Chrome’s App-Bound Encryption (ABE), a protection that previously limited Golden Chickens’ credential theft capabilities, as seen in earlier tools like TerraStealerV2.

ChromEggscalator is deployed in a staged workflow, extracting credentials and session data into structured outputs that are exfiltrated via ChonkyChicken.

Its redesign into an OCX-based helper aligned with the broader execution framework underscores a coordinated development effort.

Insikt Group said that, TAG-195 has long been associated with financially motivated cybercrime operations and has previously been linked to groups such as FIN6, Evilnum, and Cobalt Group.

The modular ChonkyChicken variant introduces the most significant architectural shift. Instead of embedding all capabilities, it uses a controller-and-plugin model where a base implant dynamically requests modules from attacker-controlled infrastructure.

Four Modular Malware Families

At least fourteen modules have been identified, covering process management, network scanning, credential operations, surveillance, and browser data extraction.

This modularity reduces static detection footprints and allows operators to tailor capabilities per intrusion, reinforcing the MaaS commercialization model.

The implant masquerades as legitimate Windows component filenames and executes through its DllInstall export.

Across all four families, Insikt Group identified consistent architectural traits, including filename-based execution gating, string obfuscation, persistence via registry Run keys, and execution through legitimate Windows binaries.

These shared characteristics confirm a unified development framework and facilitate cross-family detection strategies.

The malware also adopts WebSocket-based C2 communication compliant with RFC 6455, leveraging inherent protocol-level masking to evade signature-based inspection.

Combined with layered obfuscation, this approach complicates network-level detection and reinforces the need for behavioral analytics.

Infrastructure analysis links campaign activity to domains such as xtrafftrck.net and staging servers hosted at IP address 70.34.205.43, supporting both payload delivery and C2 operations.

The use of centralized infrastructure alongside modular payload delivery highlights operational maturity and coordination within the TAG-195 ecosystem.

The emergence of modular MaaS ecosystems like TAG-195 underscores a broader trend toward customizable, low-footprint malware frameworks designed for stealth, scalability, and persistent access in modern enterprise environments.

This latest evolution builds directly on earlier Golden Chickens malware, including TerraLogger and TerraStealerV2, which lacked robust C2 and Chrome ABE bypass capabilities.

The transition to modular, plugin-based implants with integrated encryption bypass mechanisms reflects a deliberate redesign rather than incremental improvement.

Defenders should prioritize detection of ClickFix-style execution chains, suspicious use of system utilities loading OCX payloads, abnormal browser launches with remote debugging enabled, and anomalous outbound WebSocket traffic.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist