[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCx5bDNqQoHUUG6LCtEkNzloZaEig9XLnqq48nMLs_30":3},{"article":4,"iocs":49,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"2bf471c9-4550-443f-b962-ac3de565c1b6","Golden Chickens Resurfaces With Four New Malware Families and Modular Implants","golden-chickens-resurfaces-with-four-new-malware-families-and-modular-implants-2320d2","The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and a modified web browser credential","The Golden Chickens malware-as-a-service (MaaS) ecosystem has reappeared with four new malware families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. These new tools indicate an architectural evolution and a move towards modular, operator-driven tooling for enhanced defense evasion. The group, tracked as TAG-195, is financially motivated and has been linked to other threat actors and cybercrime groups.","Golden Chickens MaaS resurfaces with four new malware families and modular implants.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fgolden-chickens-resurfaces-with-four.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjJ6m42WBQBHda1ntTqYkaxPyEiKYjc2xnTFIawfUcAxMuYQ_HtOz3ebO0HTtt3qyhUIIg8NB8W92WIfldPiOjZKCY1_aTGfgWq2NnZOhrgoU_Z8y8rtfVxCdJuc1QL94IcLm0IF_h-euFZydB5Qc8z4ifT-lx84glPyRnfTX8-R31O_0aswgRZR0uUTxs1\u002Fs1600\u002Fmalwares.jpg","2026-07-24T10:09:24+00:00","2026-07-24T12:00:24.170249+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"TAG-195","threat_actor",{"name":21,"type":19},"TAG-127",{"name":23,"type":19},"Cobalt Group",{"name":25,"type":19},"Evilnum",{"name":27,"type":19},"FIN6",{"name":29,"type":30},"TinyEgg","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[50,52,55,58],{"type":46,"value":29,"context":51},"Lightweight initial-access backdoor",{"type":46,"value":53,"context":54},"ChonkyChicken","Fully featured implant with browser credential theft and session control",{"type":46,"value":56,"context":57},"ChromEggscalator","Web browser credential theft utility",{"type":46,"value":59,"context":60},"More_eggs","Associated malware family with Golden Chickens",[29],{"controls":63,"vendors":147},[64,93,118],{"slug":65,"name":66,"problem":67,"products":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":35,"name":94,"problem":95,"products":96},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":114,"product_name":115,"url":116,"description":117},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":119,"name":120,"problem":121,"products":122},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":169},"golden-chickens-maas-evolves-with-modular-malware-arsenal","Golden Chickens MaaS Evolves With Modular Malware Arsenal","The resurgence of the Golden Chickens Malware-as-a-Service ecosystem highlights the growing sophistication of cybercriminal supply chains, where threat actors rent out constantly evolving toolkits to multiple operator groups. The introduction of four new malware families — including modular implants and a Chrome-targeting stealer — demonstrates a deliberate architectural shift designed to evade detection and complicate attribution. This modular, operator-driven model means defenders face a moving target, as each operator can customize payloads to bypass specific security controls. The financial motivation behind TAG-195 makes high-value industries such as banking, finance, and e-commerce especially vulnerable to targeted campaigns leveraging these tools.",[159,160,161,162,163,164,165,166,167,168],"CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-83 – Guide to Malware Incident Prevention and Handling","NIST DE.CM-1 – Network and Endpoint Monitoring","MITRE ATT&CK – T1199 Trusted Relationship \u002F Supply Chain Compromise","MITRE ATT&CK – T1129 Shared Modules","ISO\u002FIEC 27001 – A.16 Information Security Incident Management","NIST CSF – RS.AN (Incident Response: Analysis)",{}]