Golden Chickens Adds Four Malware Families, Including Modular ChonkyChicken
Summary
Recorded Future reports four new Golden Chickens malware families, detailing TinyEgg’s delivery and behavior, ChonkyChicken’s capabilities, and a modular variant that retrieves 14 capability modules from C2 infrastructure.
Key points
- Recorded Future tracks Golden Chickens as TAG-195 and reports four families: TinyEgg, ChonkyChicken, its modular variant, and ChromEggscalator.
- TAG-127 has reportedly used ClickFix-style social engineering to deliver TinyEgg by tricking users into executing malicious commands.
- TinyEgg profiles hosts, manages persistence, provides an interactive shell over WebSockets, and can stop when it detects sandbox or automated analysis environments.
- ChonkyChicken adds browser credential theft, Chrome DevTools Protocol session control, credential-backed remote execution, reconnaissance, and surveillance.
- The modular ChonkyChicken variant can fetch 14 capability modules from C2 on demand; the purpose of an additional module called “wtrack” is unknown.
- Recorded Future says modular tooling may reduce static detection exposure and let MaaS operators selectively provision capabilities.
Article Details
- Attack Vectors
- TAG-127 was observed using ClickFix-style social engineering to trick users into manually executing malicious commands.
- ClickFix lures led to OCX payloads downloaded from attacker-controlled staging infrastructure and installation of TinyEgg.
- TinyEgg communicates with a C2 server over WebSockets for interactive shell commands, command output, and OCX payload staging.
- The modular ChonkyChicken variant retrieves capability modules from C2 infrastructure on demand.
- ChonkyChicken supports browser credential theft and live browser-session control using Chrome DevTools Protocol.
- Defensive Notes
- The article reports that TinyEgg terminates execution when it detects sandbox or automated-analysis environments.
- The report says modularization may reduce static detection exposure; monitoring for on-demand module retrieval and WebSocket C2 may be relevant to detecting this activity.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware families share string obfuscation.T1056.001 · KeyloggingA modular ChonkyChicken component provides keylogging.T1059 · Command and Scripting InterpreterTinyEgg provides an interactive shell for operator-supplied commands, and ChonkyChicken includes command execution.T1071.001 · Web ProtocolsTinyEgg communicates with its C2 server using WebSockets.T1105 · Ingress Tool TransferOCX payloads are downloaded from attacker-controlled staging infrastructure, and ChonkyChicken modules are fetched from C2.T1113 · Screen CaptureA modular ChonkyChicken component provides screen capture.T1115 · Clipboard DataA modular ChonkyChicken component captures clipboard data.T1123 · Audio CaptureA modular ChonkyChicken component captures audio.T1204 · User ExecutionClickFix-style lures trick users into manually executing malicious commands.T1497.001 · System ChecksTinyEgg terminates execution if it detects sandbox or automated-analysis environments.T1555.003 · Credentials from Web BrowsersChonkyChicken and ChromEggscalator are described as supporting browser credential theft.
Threat Actors
Cobalt GangThe article explicitly gives Cobalt Gang as an alternative name for Cobalt Group, which it says used tools associated with More_eggs.Cobalt GroupThe article names Cobalt Group as a cybercrime group that has used tools associated with the Golden Chickens malware family More_eggs.EvilNumThe article names Evilnum as a cybercrime group that has used tools associated with the Golden Chickens malware family More_eggs.FIN6The article names FIN6 as a cybercrime group that has used tools associated with the Golden Chickens malware family More_eggs.Golden ChickensThe article describes Golden Chickens as a financially motivated MaaS developer whose ecosystem introduced the reported malware families.TAG-127The article identifies TAG-127 as an operator and customer associated with TAG-195 and reports that it deployed TinyEgg through ClickFix-style campaigns.TAG-195Recorded Future's Insikt Group tracks Golden Chickens under this moniker; the article describes TAG-195 as the financially motivated MaaS developer behind the tooling.Venom SpiderThe article explicitly identifies Venom Spider as another name for Golden Chickens, the MaaS developer associated with the reported malware.
Malware
ChonkyChickenGolden Chickens, also known as Venom Spider, has introduced four new malware families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator—showing continued development of itsChromEggscalatorfour new malware families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator—showing continued development of its malware-as-a-service ecosystem.more eggsAssociated with a malware family called More_eggs, the threat actor’s tools have been put to use by other cybercrime groups like Cobalt Group (aka Cobalt Gang), Evilnum, and FIN6.TerraStealerV2ChromEggscalator, a successor to TerraStealerV2 and a modified version of a publicly available Chrome encryption-bypass tool called ChromElevatorTinyEggGolden Chickens, also known as Venom Spider, has introduced four new malware families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator—showing continued development of its