Golden Chickens MaaS Returns with 'TinyEgg' and 'ChromEggscalator' Payloads Amid Operation Endgame Season 3

Executive Summary\nOn July 24, 2026, cybersecurity researchers identified a significant resurgence of the 'Golden Chickens' malware-as-a-service (MaaS) ecosystem. Despite the massive disruptions caused by the recent 'Season 3' of Operation Endgame—the international law enforcement campaign that successfully took down SocGholish and StealC nodes in June—the operators of Golden Chickens have debuted four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent a sophisticated evolution in the MaaS landscape, focusing on identity-centric attacks and long-term persistence within high-value enterprise networks. Initial telemetry suggests these payloads are already being utilized by financially motivated groups like FIN6 and Cobalt Group to facilitate large-scale financial fraud and data extortion.\n\n## Threat Analysis\nThe Golden Chickens ecosystem has historically provided high-tier initial access tools to some of the world's most aggressive threat actors. The current 2026 campaign marks a shift from the monolithic 'More_eggs' JScript loader toward a highly modularized architecture. This modularity allows the 'assembly line' operators to swap evasion components in real-time based on the specific security stack of the target. TinyEgg appears to be the primary lightweight stager, while ChonkyChicken serves as a versatile backdoor capable of loading secondary modules. The most alarming addition is ChromEggscalator, a utility specifically engineered to exfiltrate session tokens and saved credentials from hardened 2026-era browser environments, effectively bypassing conventional multi-factor authentication (MFA) by hijacking active sessions.\n\n## Technical Details\nTechnical analysis of TinyEgg reveals it is a heavily obfuscated JavaScript-based dropper that utilizes steganography within SVG files—a technique seen in recent 'Contagious Interview' campaigns. Once executed, TinyEgg performs extensive environmental checks, querying system metrics that were only recently standardized in late 2025 to detect sandboxing. ChromEggscalator targets the Chromium-based browser local state files, utilizing a new technique to decrypt protected tokens without triggering Windows Hello or other biometric prompts that were previously thought to be secure. The modular variant of ChonkyChicken employs a 'plug-and-play' C2 framework, which was observed utilizing legitimate 2026 cloud-native APIs for data exfiltration, making it nearly indistinguishable from legitimate business traffic. These samples also show integration with remnants of the SocGholish infrastructure, suggesting a collaboration or infrastructure-sharing agreement between major MaaS providers surviving the Endgame takedowns.\n\n## Attribution Assessment\nIntelligence analysts attribute these new developments with high confidence to the same threat group responsible for the 'More_eggs' lineage, often tracked as the 'Golden Chickens' operators. Historical associations with the Cobalt Group and FIN6 persist, as the monetization patterns seen in early July 2026 attacks involve the same money-laundering clusters used in previous years. While the primary developers are believed to reside in Eastern Europe, the MaaS model allows for a decentralized affiliate network, making full attribution of individual campaigns difficult. However, the technical signatures in the JScript obfuscation and the unique C2 heartbeat patterns are identical to those observed in the 2024 and 2025 Golden Chickens iterations.\n\n## Implications\nThe resilience of the Golden Chickens infrastructure, even in the face of Operation Endgame, underscores the limits of purely infrastructure-based takedowns. The move toward modular, identity-aware malware indicates that the 'identity as the new perimeter' paradigm is now the primary battlefield. Organizations can no longer rely on simple MFA or endpoint-only detection. The ability of ChromEggscalator to hijack session tokens means that 'always-on' session validation and identity-based micro-segmentation are now mandatory components of a modern security architecture.\n\n## Recommendations\n1. Session Token Hardening: Implement short-lived session tokens and enforce device-bound credentials to mitigate the impact of ChromEggscalator's exfiltration capabilities.\n2. Phishing Defense: Enhance employee training specifically targeting 'Contagious Interview' and social engineering tactics that involve running local 'coding challenges' or projects.\n3. Behavioral EDR Rules: Update EDR policies to flag unusual JScript/VBScript processes that attempt to access browser local state directories or establish C2 connections via cloud-native API domains.\n4. MFA Evolution: Move toward hardware-backed FIDO2 keys and away from push-based or biometric-only MFA, which current malware is increasingly able to circumvent through session hijacking.