# Venom Spider's New Toolkit Is a Blueprint for the Next Generation of MaaS
For years, Golden Chickens operated on the same basic premise: build something that works, sell it to whoever can pay, and stay quiet enough that researchers can't nail down exactly who's running the thing. That approach has funded relationships with some of the most dangerous financial threat actors on the planet — Cobalt Group, FIN6, Evilnum — while the underlying infrastructure kept humming.
They're not staying quiet anymore. And what they've built is worth paying attention to.
Recorded Future's Insikt Group has identified four new malware families attributed to TAG-195, the designation for the Golden Chickens developers, also known as Venom Spider. The new tools — TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and a Chrome credential thief called ChromEggscalator — don't just represent new functionality. They signal a deliberate architectural overhaul, one that trades the convenience of all-in-one implants for something operationally smarter and defensively harder to catch.
## The Architecture Shift Nobody Should Ignore
The headline number is 14. That's how many discrete capability modules the modular version of ChonkyChicken can load on demand from C2 infrastructure: screen capture, keylogging, audio capture, clipboard theft, file manipulation, HTTP request handling, network and domain reconnaissance, process management, browser credential theft. You name it, there's a module.
This matters enormously for defenders. Traditional detection logic for commodity implants relies on behavioral fingerprinting — you know what More_eggs looks like in memory, what network patterns it produces, what registry keys it touches. A monolithic implant does everything at once, which means it leaves a larger footprint, a more predictable one.
The modular approach inverts that calculus. Operators request only what they need for a given intrusion. If they're after credentials, they load the browser module and nothing else. If they want persistence and surveillance, they pull those. The implant's runtime behavior is variable, determined by the operator rather than baked into the binary. That's enormously harder to detect, and it means that even a well-tuned EDR can't rely on the presence of all known capabilities as an indicator — because they may never be loaded in a given session.
TinyEgg serves as the beachhead: lightweight, focused entirely on initial access and host profiling, with anti-sandbox checks and WebSocket-based C2 communication for interactive shell access. Think of it as a quiet scout that does just enough to confirm the target is worth deploying the heavy machinery on. Once it phones home with host data, ChonkyChicken takes over.
## ClickFix Keeps Winning
The delivery mechanism here should be a flashing red light for anyone running a security awareness program. TAG-127 — the operator group buying and deploying Golden Chickens tooling — is using ClickFix-style lures to trick users into manually running malicious commands. ClickFix, for those who haven't been tracking it, is a social engineering technique that presents users with a fake error dialog, then instructs them to fix the problem by pasting a command into a terminal or Run dialog. The user does the execution themselves, bypassing many endpoint controls that would catch an automated execution.
It's embarrassingly effective, and it keeps showing up because it works. The technique targets the weakest part of any security stack: the person at the keyboard. Once the user runs the OCX payload that gets fetched from attacker-controlled infrastructure, TinyEgg is installed and the intrusion begins in earnest.
## Chrome Is the New Crown Jewel
ChromEggscalator deserves its own paragraph. It's a successor to TerraStealerV2 and a modified version of ChromElevator, a publicly available tool designed to bypass Chrome's encryption protections for stored credentials. Chrome's Application-Bound Encryption was supposed to make credential theft harder — and it did raise the bar for older stealers. ChromEggscalator clears that bar.
The broader ChonkyChicken implant takes this further, using Chrome DevTools Protocol for live browser session control. This isn't just dumping saved passwords — it's the ability to interact with an active authenticated browser session in real time. That means active banking sessions, corporate SaaS platforms, email accounts. The credentials don't even need to be stored for exfiltration; the session itself can be abused while the user is logged in.
For any organization where employees access financial systems, cloud infrastructure, or sensitive business applications through the browser — which is most organizations — this is a serious operational concern.
## HackWire Analysis
The Golden Chickens story gets told as an isolated development every time new reporting drops. It shouldn't be.
What TAG-195 is building sits at the intersection of two converging trends: the professionalization of MaaS operations and the arms race against browser security improvements. The modular architecture isn't original to them — it mirrors approaches used by mature ransomware-as-a-service outfits that long ago figured out that flexibility beats monolithic builds when defenders keep improving signature coverage. The fact that Golden Chickens has now adopted this model suggests MaaS is catching up to RaaS in operational sophistication.
The customer list should sharpen the threat picture. Cobalt Group, FIN6, and Evilnum aren't script kiddies — they're organized, persistent, and financially motivated actors with a track record against banks, financial institutions, and payment processors. When an advanced MaaS developer upgrades its toolkit and hands better tools to these groups, the downstream exposure is concentrated in financial services. If you're a CISO at a bank, a fintech, or a payment processor, Golden Chickens tooling is not an abstract concern.
There's also a detail getting insufficient attention in the coverage: the WebSocket-based C2 for TinyEgg's interactive shell. WebSocket traffic blends naturally into legitimate web traffic, making it harder to flag on network monitoring without deep packet inspection or behavioral baselines. Organizations that lack mature network detection should treat this as a concrete gap to close.
For defenders right now: ClickFix-style attacks mean user training isn't optional patching — it's your primary control at the delivery stage. EDR tuning needs to account for modular payload loading rather than static capability signatures. And Chrome session protection, not just credential storage protection, should be on the configuration checklist.
The group called their tool ChonkyChicken. Don't let the name make you comfortable.
— HackWire Editorial
---
## Related Coverage