Loading malware…
TerraStealerV2 is a Windows information-stealing malware family associated with the Golden Chickens malware-as-a-service ecosystem, also known as Venom Spider. Observed in 2025, it is designed to harvest browser credentials, cryptocurrency wallet data, and browser extension information. The malware specifically targets Google Chrome credential stores and attempts to access saved login data, while also collecting basic host-identification information prior to exfiltration.
TerraStealerV2 has been distributed in multiple Windows payload formats and is commonly staged as an OCX component executed through trusted Windows utilities, notably regsvr32, with some observed delivery chains also using mshta. It includes anti-analysis and execution-context checks, such as validating its expected file type and launch conditions, and uses string obfuscation to hinder static analysis. The malware also enumerates running processes and may terminate Chrome in order to release locks on browser databases before copying and querying credential data.
Its theft functionality centers on extracting saved Chrome login records and collecting data from cryptocurrency wallet and browser-extension storage locations. Reporting indicates that its Chrome credential theft implementation lacked a bypass for Chrome Application Bound Encryption protections introduced in mid-2024, limiting successful decryption on fully updated systems and suggesting the family was either immature or still under active development during the observed period. Exfiltration has been observed via Telegram as well as attacker-controlled web infrastructure.
TerraStealerV2 is part of a broader Golden Chickens toolset used by financially motivated operators and customers linked to credential theft and follow-on intrusion activity. Golden Chickens tooling has historically been used by multiple cybercriminal groups. Compared with more mature malware in that ecosystem, TerraStealerV2 appears comparatively narrow in scope and less refined, but it reflects continued development of credential- and wallet-theft capabilities within the service’s Windows-focused arsenal.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ChromEggscalator, a successor to TerraStealerV2 and a modified version of a publicly available Chrome encryption-bypass tool called ChromElevator.
"C. TerraStealerV2 Credential-harvesting malware targeting browsers, FTP clients, and email platforms."
Insikt Group identified two new malware families — TerraStealerV2 and TerraLogger — linked to the financially motivated threat actor Golden Chickens (also known as Venom Spider). TerraStealerV2 is designed to collect browser credentials, cryptocurrency wallet data, and browser extension information.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An earlier stealer referenced only as the predecessor to ChromEggscalator.
Referenced only as comparative background regarding browser ABE bypass capability maturity.
Steals browser credentials, cryptocurrency wallet data, and browser extension information.
Information stealer associated with Golden Chickens MaaS, targeting credentials, crypto wallet data, and browser/extension information.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.