The Golden Chickens threat actors are attributed to two novel malware families, dubbed TerraStealerV2 and TerraLogger, indicating continued development efforts to enhance their arsenal.
According to the Recorded Future Insikt Group, “TerraStealerV2 is designed to harvest browser credentials, cryptocurrency wallet data, and browser extension information,” while “TerraLogger, by contrast, is a standalone keylogger that uses a low-level keyboard hook to record keystrokes, writing the logs to local files.”
The Golden Chickens, also known as Venom Spider, have been linked to a notorious malware family called More_eggs and are known to be active since at least 2018, offering their services under a malware-as-a-service (MaaS) model.
As of 2023, Golden Chickens has been tied to an online persona known as badbullzvenom, an account believed to be operated jointly by individuals from Canada and Romania, with other malicious tools developed by the group including More_eggs lite, VenomLNK, TerraLoader, and TerraCrypt.
Last year, Zscaler ThreatLabz detailed new Golden Chickens-related activity involving a backdoor called RevC2 and a loader referred to as Venom Loader, both delivered via VenomLNK.
The latest findings from Recorded Future indicate that the threat actors are continuing to work on their offerings, releasing an updated version of their stealer malware capable of harvesting browser data, cryptocurrency wallet information, and browser extensions.
TerraStealerV2 has been distributed through various formats, including executable files, dynamic-link libraries, Windows Installer packages, and shortcut files, with the stealer payload delivered as an OCX file retrieved from an external domain.
However, it does not bypass Application Bound Encryption (ABE) protections introduced in Chrome updates after July 2024, indicating the malware code may be outdated or under development.
The data captured by TerraStealerV2 is exfiltrated to both Telegram and the domain “wetransfers[.]io,” and it leverages trusted Windows utilities to evade detection.
TerraLogger, also propagated as an OCX file, is designed to record keystrokes but does not include functionality for data exfiltration or command-and-control communication, suggesting it is in early development or intended for use with another malware part of the Golden Chickens MaaS ecosystem.
Recorded Future notes that both TerraStealerV2 and TerraLogger remain under active development and do not yet exhibit the level of stealth typically associated with mature Golden Chickens tooling.
Given Golden Chickens’ history of developing malware for credential theft and access operations, these capabilities will likely continue to evolve.
This discovery comes amid the emergence of new stealer malware families like Hannibal Stealer, Gremlin Stealer, and Nullpoint Stealer, designed to exfiltrate sensitive information from victims.
This also follows the discovery of an updated version of the StealC malware with support for streamlined command-and-control communication protocol and RC4 encryption.
Zscaler ThreatLabz reported that the malware’s payload delivery options have been expanded to include Microsoft Software Installer packages and PowerShell scripts.
A redesigned control panel provides an integrated builder that enables threat actors to customize payload delivery rules based on geolocation, hardware IDs, and installed software, with additional features including multi-monitor screenshot capture and server-side brute-forcing for credentials.
The new 2.2.4 version of StealC, introduced in March 2025, has been observed being distributed via another malware loader called Amadey, with the control panel supporting Telegram bot integration for sending notifications and allowing customization of message formats.
Zscaler noted that StealC V2 introduces improvements, such as enhanced payload delivery, a streamlined communications protocol with encryption, and a redesigned control panel providing more targeted information collection.
