Golden Chickens MaaS Resurfaces: Detecting TinyEgg, ChonkyChicken, and Browser Credential Theft

The operators behind the Golden Chickens Malware-as-a-Service (MaaS) ecosystem have actively resumed operations, undeterred by previous public disclosures. In a significant escalation of capabilities, the group has deployed four new malware families: TinyEgg, ChonkyChicken (and a modularized variant), and a modified web browser credential harvester.

For defenders, this is not a theoretical risk. Golden Chickens is a prolific Initial Access Broker (IAB) supplier; their malware is the front door for ransomware operators and nation-state actors. The introduction of modular implants like ChonkyChicken suggests a shift toward increased persistence and adaptability, allowing attackers to dynamically load post-compromise capabilities tailored to the victim environment. Immediate action is required to bolster detection gaps regarding credential theft and modular loader behavior.

Technical Analysis

Golden Chickens has historically relied on JavaScript-based loaders and fileless techniques to evade signature-based defenses. This latest iteration continues that trend while increasing obfuscation.

Malware Families

TinyEgg: Likely a lightweight downloader or dropper designed to establish a foothold and fetch subsequent payloads. Its small footprint suggests an emphasis on evasion and speed.
ChonkyChicken & Modular Variant: A more robust payload, potentially serving as the core implant. The modularized variant indicates the use of a plugin architecture, allowing the threat actor to load modules for reconnaissance, lateral movement, or data exfiltration only when needed, reducing the runtime attack surface.
Modified Web Browser Credential Stealer: This component targets the "supply chain" of user identities. By modifying known credential theft techniques, the actors aim to bypass security controls that flag standard stealer behavior.

Attack Chain & Exploitation Status

The infection vector typically follows a phishing-social engineering pattern, delivering malicious payloads via macros or HTML Application (HTA) files.

Initial Access: User executes a malicious file (e.g., TinyEgg).
Execution: TinyEgg runs obfuscated PowerShell or JavaScript to download ChonkyChicken.
Persistence: ChonkyChicken establishes persistence via Registry run keys or scheduled tasks.
Credential Access: The modified browser stealer accesses SQLite databases (e.g., Login Data) for Chrome or Edge to harvest session tokens and passwords.

Exploitation Status: Confirmed active exploitation in the wild. No specific CVEs are associated with this malware release itself; the threat relies on social engineering and abusing OS trust rather than an unpatched vulnerability.

Detection & Response

Detecting Golden Chickens requires focusing on behavioral anomalies rather than static signatures. Given the modular nature of ChonkyChicken and the specificity of the browser stealer, the following rules prioritize high-fidelity indicators of credential theft and suspicious process lineage.

SIGMA Rules

YAML

---
title: Golden Chickens Browser Credential Theft Activity
id: 8a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects processes accessing browser Login Data or Cookies files, indicative of credential theft activity common in Golden Chickens campaigns.
references:
  - https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\Google\\Chrome\\User Data\\Default\\Login Data'
      - '\\Google\\Chrome\\User Data\\Default\\Cookies'
      - '\\Microsoft\\Edge\\User Data\\Default\\Login Data'
      - '\\Microsoft\\Edge\\User Data\\Default\\Cookies'
  filter_legitimate:
    Image|contains:
      - '\\chrome.exe'
      - '\\msedge.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Third-party backup or password management tools interacting with browser stores
level: high
---
title: Suspicious PowerShell Downloaders (TinyEgg/Loader)
id: 9c3d4e5f-6a7b-5c8d-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell commands often used by loaders like TinyEgg to download payloads from the internet, specifically using common obfuscation techniques.
references:
  - https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_obfuscation:
    CommandLine|contains:
      - 'FromBase64String'
      - 'DownloadString'
      - 'IEX'
  selection_network:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: all of selection_*
falsepositives:
  - Legitimate system administration scripts utilizing web requests
level: medium
---
title: Potential ChonkyChicken Persistence via Run Keys
id: 0d4e5f6a-7b8c-6d9e-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects suspicious executables or scripts launched from Registry Run keys located in user profile AppData, a common persistence mechanism for modular implants.
references:
  - https://thehackernews.com/2026/07/golden-chickens-resurfaces-with-four.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
  selection_value:
    Details|contains:
      - '\\AppData\\Roaming\'
      - '\\AppData\\Local\'
  filter_legitimate:
    Details|contains:
      - 'Microsoft'
      - 'Google'
      - 'Dropbox'
  condition: selection_key and selection_value and not filter_legitimate
falsepositives:
  - Legitimate software auto-updaters or startup entries
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes accessing browser credential files, identified in the technical analysis as a capability of the new modified stealer.

KQL — Microsoft Sentinel / Defender

// Hunt for Browser Credential Theft
DeviceFileEvents
| where FolderPath endswith \"\\\Login Data\" 
   or FolderPath endswith \"\\\Cookies\"
| where InitiatingProcessFileName !in (\"chrome.exe\", \"msedge.exe\", \"brave.exe\")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, 
          InitiatingProcessCommandLine, FolderPath, ActionType
| summarize count() by DeviceName, InitiatingProcessFileName

Velociraptor VQL

This artifact hunts for processes that have open handles to sensitive browser database files, a reliable method to catch the "modified web browser credential" malware in memory.

VQL — Velociraptor

-- Hunt for processes accessing Chrome/Edge credential databases
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE Exe NOT IN (\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\", 
                   \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\")

LET handles = SELECT Pid, Name, Handle, Type
FROM handles(pid=Pid)
WHERE Name =~ \"Login Data\" OR Name =~ \"Cookies\"

SELECT * FROM foreach(row=pslist(), query={
    SELECT Pid, Name, CommandLine FROM handles
})

Remediation Script (PowerShell)

This script assists IR teams in identifying suspicious persistence mechanisms often used by ChonkyChicken variants in user profiles.

PowerShell

# Check for suspicious persistence entries in User Run Keys
$SuspiciousPaths = @(\"AppData\\Roaming\", \"AppData\\Local\")
$RunKeys = @(
    \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\",
    \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"
)

foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key -ErrorAction SilentlyContinue | 
        Get-Member -MemberType NoteProperty | 
        Where-Object { $_.Name -ne \"PSPath\" -and $_.Name -ne \"PSParentPath\" -and $_.Name -ne \"PSChildName\" -and $_.Name -ne \"PSDrive\" -and $_.Name -ne \"PSProvider\" } | 
        ForEach-Object {
            $PropName = $_.Name
            $PropValue = (Get-ItemProperty $Key).$PropName
            if ($PropValue -match [regex]::Escape($env:APPDATA) -or $PropValue -match [regex]::Escape($env:LOCALAPPDATA)) {
                # Check for known legitimate vendors to reduce noise (heuristic)
                $KnownVendors = @(\"Microsoft\", \"Google\", \"Dropbox\", \"Zoom\", \"Slack\", \"Adobe\")
                $IsKnown = $false
                foreach ($vendor in $KnownVendors) {
                    if ($PropValue -like \"*$vendor*\") { $IsKnown = $true; break }
                }
                if (-not $IsKnown) {
                    Write-Host \"[!] Suspicious Persistence Found: $PropName\" -ForegroundColor Yellow
                    Write-Host \"    Path: $PropValue\"
                }
            }
        }
    }
}

Remediation

Isolate and Remediate: Identify hosts triggering the "Browser Credential Theft" detection. Isolate them from the network immediately to prevent lateral movement or C2 communication.
Credential Reset: Assume all web session cookies and saved passwords in browsers on affected hosts are compromised. Force a password reset for all accounts accessed from those machines within the suspicious timeframe.
Persistence Removal: Use the provided PowerShell script to audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Remove entries pointing to unsigned binaries in AppData directories.
Application Allowlisting: Restrict the execution of PowerShell and WScript to specific administrative users or signed scripts only to impede the execution of TinyEgg and subsequent loaders.
Browser Hardening: Enforce Enterprise Mode management policies to prevent unauthorized extensions and clear cached credentials/cookies upon browser closure via Group Policy.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub