Malware

VenomLNK

VenomLNK is the initial phase of the more_eggs malware-as-a-service. It is a poisoned .lnk file that depends on User Execution and points to LOLBINs (often cmd.exe) with additional obfuscated scripting options. This typically initiates WMI abuse and TerraLoader, which can load additional functionality through various plugins.

MITRE ATT&CK TTPs 16

T1003
OS Credential Dumping
Credential Access
 T1005
Data from Local System
Collection
 T1021
Remote Services
Lateral Movement
 T1040
Network Sniffing
Credential Access
 T1056.001
Keylogging
Collection
 T1059
Command and Scripting Interpreter
Execution
 T1059.001
PowerShell
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1074
Data Staged
Collection
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1110
Brute Force
Credential Access
 T1123
Audio Capture
Collection
 T1203
Exploitation for Client Execution
Execution
 T1566
Phishing
Initial Access

Source Articles

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.
hacker-news ·4d ago