TAG-195

Golden Chickens, also tracked as TAG-195 and Venom Spider, is a financially motivated malware-as-a-service developer and operator ecosystem that supplies intrusion tooling to multiple criminal customers. The group is associated with modular Windows malware used across the intrusion lifecycle, including initial access, persistence, credential theft, browser session abuse, reconnaissance, lateral movement, remote execution, surveillance, and data exfiltration. Public reporting has linked Golden Chickens tooling to financially motivated threat groups including FIN6, Cobalt Group, Evilnum, and TAG-127. The ecosystem includes malware families such as TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. TinyEgg functions as a lightweight initial-access backdoor with host profiling, shell access, and persistence management. ChonkyChicken is a second-stage or post-exploitation implant designed to turn a compromised Windows endpoint into a platform for broader enterprise compromise. It supports browser credential theft, session hijacking through browser automation, credential-backed and token-backed remote execution, host and network discovery, share enumeration, port scanning, scheduled-task creation, and sustained monitoring of victim activity. Surveillance features include keylogging, clipboard capture, screenshot collection, and audio recording. A notable capability in this ecosystem is theft and abuse of authenticated browser state. ChonkyChicken can automate live Chrome and Edge sessions through Chrome DevTools Protocol to interact with already authenticated business services, while ChromEggscalator is used to bypass Chrome App-Bound Encryption protections and extract protected browser secrets. The malware family also supports optional traffic-interception workflows and uses modular plugin delivery to selectively load capabilities on demand, reducing static footprint and enabling operator-directed deployment. Across its malware families, Golden Chickens shows a consistent development framework characterized by OCX-packaged payloads, execution through legitimate Windows COM registration mechanisms, WebSocket-based command and control, JSON tasking, string obfuscation or encryption, filename-gating checks, and persistence via Windows Run keys. The architecture indicates a mature criminal service model focused on supplying adaptable post-compromise tooling to financially motivated operators.