Venom Spider, the financially motivated threat actor also known as Golden Chickens, has been developing a malware toolset under its Malware-as-a-Service (MaaS) business. Cybersecurity researchers have discovered and analyzed recent campaigns leveraging a novel backdoor and loader named after Venom Spider’s toolset. Venom Spider’s malware has been linked to cybercrime groups Cobalt and Fin6, and CTIX analysts reported on the use of the “More_eggs” backdoor linked to Venom Spider in recent campaigns this year. The two (2) new malware variants recently uncovered are Venom Loader and a backdoor named RevC2. The RevC2 backdoor uses WebSockets for command-and-control (C2) communications, enabling the transfer of stolen data such as browser cookies and passwords and remote code execution (RCE). The RevC2 backdoor was observed in a campaign that used API documentation as a lure. The backdoor can also take screenshots of the victim’s system and proxy network data. Venom Loader is notable for its novel use of the victim’s computer name to encode its payloads. Venom Loader was discovered in campaigns using a cryptocurrency lure where Venom Loader was used to dispatch a JavaScript backdoor with RCE capabilities. Venom Loader uses a DLL file that is custom built for the victim environment and uses the system’s computer name as the XOR key to encode its attack stages. Venom Spider’s MaaS capabilities are expected to expand, as these recent findings suggest the toolset is in active development. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.