Golden Chickens

2026-07-2312 minRecorded Futurehigh

Insikt Group documents four new TAG-195 (Golden Chickens) malware families — TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator — representing an architectural shift from monolithic implants toward a controller-and-plugin model that loads capability modules on demand from C2. All variants share consistent evasion techniques (filename execution gating, OCX/regsvr32.exe execution, WebSocket JSON C2, and identical Run key persistence), and the ecosystem now includes a Chrome App-Bound Encryption bypass helper and live Chrome DevTools Protocol session hijacking, closing previously identified capability gaps in the group's tooling.