Malware

More_eggs

Also known as: SKID · SpicyOmelette

More_eggs is a JavaScript backdoor used by the Cobalt group. It attempts to connect to its C&C server and retrieve tasks to carry out, some of which are: - d&exec = download and execute PE file - gtfo = delete files/startup entries and terminate - more_eggs = download additional/new scripts - more_onion = run new script and terminate current script - more_power = run command shell commands

MITRE ATT&CK TTPs 16

T1003
OS Credential Dumping
Credential Access
 T1005
Data from Local System
Collection
 T1021
Remote Services
Lateral Movement
 T1040
Network Sniffing
Credential Access
 T1056.001
Keylogging
Collection
 T1059
Command and Scripting Interpreter
Execution
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1074
Data Staged
Collection
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1110
Brute Force
Credential Access
 T1123
Audio Capture
Collection
 T1203
Exploitation for Client Execution
Execution
 T1566
Phishing
Initial Access

Source Articles

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.
hacker-news ·4d ago