Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
Summary: Recorded Future's Insikt Group reports that the Golden Chickens malware-as-a-service ecosystem, tracked as TAG-195, has returned with four new malware families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and a modified browser credential theft utility called ChromEggscalator. The four families share command-and-control mechanisms, a persistence approach, string obfuscation, and the same delivery model, with TAG-127 observed deploying TinyEgg through ClickFix-style social engineering that tricks users into manually executing malicious commands.
Key Takeaway: The modular ChonkyChicken variant pulls 14 components from its C2 infrastructure on demand, including a module named wtrack whose purpose is unknown, which reduces the base implant's static detection exposure and lets operators provision capabilities selectively to customers. Golden Chickens tooling has already been used by Cobalt Group, Evilnum, and FIN6, so a MaaS shop that keeps shipping after extensive public disclosure is a supply problem for every downstream operator.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026