Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential

The article reports that the Golden Chickens (Venom Spider) malware-as-a-service ecosystem has resurfaced with four new malware families—TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator—focused on credential theft, modular implants, and live browser session control.[1][3] These tools expand the group’s MaaS capabilities that already include credential stealers and keyloggers such as TerraStealerV2 and TerraLogger, which target browser credentials, crypto wallets, and keystrokes for financially motivated attacks.[2][6] From a RealGround perspective, this demonstrates how rapidly evolving, modular crimeware can be integrated into automated attack chains, including AI-driven tooling and scripting, to scale credential theft and session hijacking against AI-enabled SaaS and enterprise environments. Continuous AI Red Teaming is critical to emulate such MaaS-powered campaigns, test AI agents and supporting infrastructure against credential-stealing, session-hijacking, and modular malware delivery scenarios, and continuously harden detection and response playbooks.