Golden Chickens Shows Browser Sessions Are the New Malware Prize

Recorded Future’s Insikt Group is tracking a new phase in the Golden Chickens malware-as-a-service ecosystem, also known as TAG-195 or Venom Spider. The important part for defenders is not just that there are new malware names. It is that the tooling is becoming more modular, more operator-driven, and more focused on browser credentials and live browser sessions.

The original research describes four newly identified families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. Together, they show a practical evolution from one-shot credential theft toward a staged intrusion model: get initial access, profile the host, load only the needed modules, and then expand into browser theft, reconnaissance, surveillance, and command execution.

Source: Recorded Future / Insikt Group. Additional reporting: The Hacker News.

What changed

Golden Chickens has long been associated with financially motivated criminal operations and malware-as-a-service customers. This latest reporting points to a more mature architecture. TinyEgg acts as a lightweight first-stage backdoor. ChonkyChicken expands capability with browser credential theft, live session control through Chrome DevTools Protocol, network reconnaissance, clipboard capture, keylogging, screen capture, and remote execution. The modular version can request individual plugins from attacker infrastructure instead of carrying every function inside the base implant.

That matters because modular malware is harder to judge from a single binary. A sandbox may only see a small initial implant. The more damaging capability may arrive later, only after the operator decides the host is worth burning additional tooling on.

Why SMBs and government contractors should care

This is the kind of tooling that turns ordinary endpoint compromise into business compromise. Browser sessions increasingly hold access to Microsoft 365, Google Workspace, GitHub, cloud dashboards, banking portals, help desks, VPN consoles, and customer systems. If an attacker can steal cookies, manipulate a live browser session, or launch the browser with remote debugging enabled, MFA may not stop the intrusion by itself.

For government contractors, the risk is sharper. A single compromised workstation can expose proposal systems, controlled project data, subcontractor portals, cloud storage, email threads, and identity-provider sessions. For SMBs, the same pattern can bypass the tools they most rely on: password managers, SSO, browser-based SaaS, and managed remote support workflows.

Defensive priorities

• Hunt for ClickFix-style execution. Look for users launching Run dialogs, PowerShell, mshta, regsvr32, rundll32, or other native utilities immediately after visiting fake verification pages.
• Monitor browser remote-debugging abuse. Alert when Chrome, Edge, Brave, or Chromium launch with remote debugging flags, unusual user-data directories, or unexpected DevTools ports.
• Treat browser token theft as an identity incident. Reset passwords alone is not enough. Revoke sessions, rotate refresh tokens, review OAuth grants, and inspect mailbox/cloud activity after compromise.
• Block persistence in user-writable paths. Watch Run keys and startup entries that execute OCX, DLL, script, or renamed payloads from AppData, Downloads, Temp, or other user-controlled directories.
• Strengthen egress visibility. WebSocket-based command-and-control can blend into normal web traffic. Proxy logs, DNS logs, TLS destinations, and endpoint network telemetry need to be retained and searchable.
• Reduce browser blast radius. Separate admin workstations, enforce phishing-resistant MFA for privileged access, limit persistent sessions, and restrict which endpoints can access sensitive SaaS consoles.

Bulwark Black assessment

The defender takeaway is simple: malware crews are building around the way modern businesses actually work. The browser is no longer just where phishing starts. It is where identity, cloud administration, customer data, source code, help desk access, and financial workflows converge.

Golden Chickens’ shift toward modular implants and browser-session capability is a warning to move beyond “did the antivirus block the file?” The better question is: if a user workstation is compromised for twenty minutes, which browser sessions, cloud roles, SaaS portals, and customer systems can the attacker reach before anyone notices?