Golden Chickens Back With Data-Stealing Malware

Golden Chickens’ new malware tools, TerraStealerV2 and TerraLogger, pose rising threats by stealing browser data and recording user keystrokes, researchers warn.

The cybersecurity researchers at Insikt Group identified two new malicious tools which belong to the well-known hacker group Golden Chickens, also known as Venom Spider. The researchers identified TerraStealerV2 and TerraLogger as new malware strains.

Golden Chickens is a financially driven threat group that provides malware to cybercriminals as part of a service. Their tools have been used by major hacking groups like FIN6 and Evilnum, linked to damages of over $1.5 billion worldwide.

TerraStealerV2 is designed to steal data from victims’ computers, including browser login credentials, crypto wallet information, and browser extensions. It grabs this data from Chrome’s login database but can’t access information protected by Chrome’s latest security upgrades.

The malware sends stolen data to a Telegram channel and the website wetransfers[.]io. It spreads through multiple file types like LNK, MSI, DLL, and EXE, and uses built-in Windows tools to avoid detection.

The second tool, TerraLogger, functions as a keylogger which logs all keyboard entries from victim computers. The tool lacks data transmission capabilities which indicates it remains unfinished or serves as a component of a comprehensive malware system.

The researchers say that Golden Chickens, which has been around since at least 2018, usually tricks victims with fake job offers or resumes to install malware. The group’s earlier attacks have affected major companies like British Airways and Ticketmaster UK.

Insikt Group warns that both tools could evolve quickly and urges organizations to take steps to protect against them before they mature further.