Golden Chickens TAG-195 resurfaces with four new malware families
Malware Activity
Summary
Hide ▲
Show ▼
The Golden Chickens malware ecosystem has resurfaced with four new malware families, expanding its tooling for initial access, credential theft, and modular delivery. The activity is linked to TAG-195 and shows continued development despite prior public exposure of the group’s inner workings. The new tooling increases operator flexibility and reduces detection exposure through a more modular, operator-driven design.
Related Happenings
Golden Chickens TAG-195 shifts to modular operator-driven MaaS tooling
Threat Actor Meta
H score28
First: 24.07.2026 13:09
Last: 24.07.2026 13:09
Sources 1
How related:
The shift is a sign that Golden Chickens, also called Venom Spider, is actively refining its arsenal through active development, while deliberately moving to modular, operator-driven tooling for defense evasion.
About this happening:
Golden Chickens operators, tracked as TAG-195, are refining their malware-as-a-service ecosystem with modular, operator-driven tooling, increasing defense-evasion...
Golden Chickens TAG-195 shifts to modular operator-driven MaaS tooling
Threat Actor MetaHow related: The shift is a sign that Golden Chickens, also called Venom Spider, is actively refining its arsenal through active development, while deliberately moving to modular, operator-driven tooling for defense evasion.
About this happening: Golden Chickens operators, tracked as TAG-195, are refining their malware-as-a-service ecosystem with modular, operator-driven tooling, increasing defense-evasion...
Timeline
-
24.07.2026 13:09 2 articles · 9h ago
Golden Chickens resurfaces with TinyEgg, ChonkyChicken, and ChromEggscalator
Initial DisclosureRecorded Future’s Insikt Group tracked Golden Chickens as TAG-195 after the malware-as-a-service ecosystem resurfaced with four new families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. The tooling reflects a shift toward modular, operator-driven malware with shared command-and-control mechanisms, shared persistence, string obfuscation, and on-demand capability loading. TAG-127 was also observed deploying TinyEgg through ClickFix-style social engineering, while TinyEgg served as a lightweight initial-access backdoor and ChonkyChicken expanded into browser credential theft, Chrome DevTools Protocol (CDP) session control, remote execution, reconnaissance, and surveillance. The modular ChonkyChicken design can fetch 14 components from C2 infrastructure as needed, and ChromEggscalator is described as a successor to TerraStealerV2 and a modified version of ChromElevator.
Show sources
- Golden Chickens Resurfaces With Four New Malware Families and Modular Implants — thehackernews.com — 24.07.2026 13:09
- Golden Chickens Resurfaces With Four New Malware Families and Modular Implants — thehackernews.com — 24.07.2026 13:09