Golden Chickens Malware Crew Returns With Four New Tools
The criminal group behind a long-running malware-as-a-service operation has rolled out fresh code, including a stripped-down loader and a browser password stealer.
Key points
- Researchers say the operators of the Golden Chickens malware-as-a-service platform have returned with four new malware families.
- The new tools are TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and a modified browser credential stealer.
- Malware-as-a-service means criminals rent ready-made hacking tools to other criminals, much like renting software online.
- The group has kept operating despite years of public research exposing how its tools work.
- This is a threat-intelligence disclosure, not a confirmed breach at any named company.
The crew behind Golden Chickens is back. Security researchers say the group, which rents hacking tools to other criminals, has released four new pieces of malware. "Malware-as-a-service" means the authors lease it out for a fee, the way a legitimate company might lease accounting software.
The finding was first reported by The Hacker News, drawing on fresh analysis of the group's activity.
Who are Golden Chickens?
Golden Chickens is the nickname researchers use for a criminal operation that builds hacking tools and rents them to other attackers. Its code has turned up in financial fraud and targeted intrusions for years. Public write-ups have exposed how the tools work. The operators keep going anyway.
Think of it as a supplier, not a gang that carries out the burglaries itself. The customers do the breaking in. Golden Chickens sells the crowbar.
What are the four new tools?
The four new families are TinyEgg, ChonkyChicken, a modular version of ChonkyChicken, and a modified tool that steals passwords saved in web browsers. Each plays a different role in an attack.
| Tool | What it appears to do |
|---|---|
| TinyEgg | A small loader, meaning code that quietly pulls in more malware once it lands on a machine |
| ChonkyChicken | A larger implant that gives attackers a foothold inside a computer |
| ChonkyChicken (modular) | The same implant broken into swappable parts, so operators can add features on demand |
| Browser credential stealer | A modified tool that scrapes usernames and passwords saved in browsers like Chrome or Edge |
A modular build lets the criminals mix and match features without rewriting the whole program. That makes the malware harder for antivirus tools to spot and easier for the operators to update.
Why does this matter to ordinary people?
Most readers won't see the name Golden Chickens in a news alert about their own bank or employer. The risk is indirect. These tools tend to ride inside phishing campaigns, where criminals send fake emails to trick staff into opening a booby-trapped attachment or link. A click is all it takes.
The browser credential stealer has the most direct reach. If it runs on a work laptop, every password the user saved in Chrome or Edge, for email, banking portals, internal systems, can be lifted in seconds. Golden Chickens isn't the only crew chasing browser passwords right now: two separate campaigns used similar credential-theft techniques between April and June 2026, as we reported in July.
What should organisations do now?
Treat it as a nudge, not a fire drill. There's no named victim in this disclosure. The practical response is the same as for any credential-stealing malware: assume phishing is the delivery route, and shorten the distance between a click and a locked-down account.
That means multi-factor authentication on anything that touches money or customer data, so a stolen password alone isn't enough to get in. It also means training staff to recognise lure emails and watching for quiet loaders like TinyEgg, which are designed to slip past first-line defences without noise.
Should you worry?
The fact that Golden Chickens is still shipping new code, years after being outed in public research, is the real headline. Exposure alone doesn't shut these operations down. If anything, the modular design of the new ChonkyChicken variant suggests the operators are getting more disciplined, not less. Watch for these tools turning up inside the kind of phishing lures that ClickFix campaigns have already normalised.
