Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

The resurgence of the Golden Chickens Malware-as-a-Service ecosystem highlights the growing sophistication of cybercriminal supply chains, where threat actors rent out constantly evolving toolkits to multiple operator groups. The introduction of four new malware families — including modular implants and a Chrome-targeting stealer — demonstrates a deliberate architectural shift designed to evade detection and complicate attribution. This modular, operator-driven model means defenders face a moving target, as each operator can customize payloads to bypass specific security controls. The financial motivation behind TAG-195 makes high-value industries such as banking, finance, and e-commerce especially vulnerable to targeted campaigns leveraging these tools.