FIN6

Golden Chickens is a financially motivated cybercrime malware-as-a-service operator and developer best known for the More_eggs malware ecosystem. The group is widely tracked under aliases including Venom Spider, Skeleton Spider, TA4557, Storm-0538, TAG-195, and Camouflage Tempest. Reporting has also associated the cluster with names such as Gold Franklin, ITG08, Taal, and Magecart Group 6, though alias usage varies by vendor and some labels may reflect overlapping tracking rather than perfectly identical scoping. Golden Chickens develops and maintains modular intrusion tooling that is used both directly and by customer threat actors. Its malware has been linked to financially motivated groups including FIN6, Cobalt Group, Evilnum, and TAG-127. The ecosystem is notable for commercialized access and post-exploitation capability delivery, with tooling sold or provided to a select criminal customer base rather than tied to a single intrusion set. The actor is strongly associated with More_eggs, a JavaScript backdoor used for initial access, profiling, persistence, and follow-on payload delivery. More recent activity shows continued development of the ecosystem through additional malware families including TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. These families indicate an architectural shift toward modular, operator-driven tooling with shared command-and-control patterns, persistence approaches, obfuscation methods, and delivery models. TinyEgg has been used as a lightweight initial-access backdoor for host profiling and shell access, while ChonkyChicken expands capability into browser credential theft, browser session control, reconnaissance, remote execution, and surveillance. The modular ChonkyChicken design supports on-demand loading of discrete capability modules, improving flexibility and likely reducing static detection exposure. ChromEggscalator has been described as a customized browser credential theft helper derived from publicly available Chrome encryption-bypass tooling. Golden Chickens commonly relies on social engineering and lure-based delivery. The group’s operations have repeatedly targeted human resources and recruiting workflows, including fake job application and résumé themes. Associated campaigns have used malicious shortcut files, archive-based lures, JavaScript payloads, living-off-the-land execution chains, and ClickFix-style user-execution prompts. Observed tradecraft includes heavy obfuscation, staged payload delivery, abuse of legitimate Windows utilities, persistence via Registry Run keys, and anti-analysis checks in early-stage implants. Victimology is primarily opportunistic and financially motivated, with tooling deployed by criminal operators against enterprises in sectors such as retail, hospitality, finance, and corporate environments where credential theft, payment-card theft, or broader monetization opportunities exist. Golden Chickens is not generally characterized as a nation-state actor; it is best understood as a cybercriminal service provider whose malware supports intrusion, credential theft, and downstream fraud or ransomware-adjacent operations. The group’s significance lies in its role as an enabler within the cybercrime ecosystem. Rather than being defined solely by one campaign, Golden Chickens functions as a persistent malware supplier whose evolving toolsets support multiple intrusion actors across successive generations of financially motivated operations.