Taurus Project stealer now spreading via malvertising campaign

guest · Oct 1, 2020

‘Taurus’ Malicious Ad Campaign Puts Data At Risk
September 28, 2020
https://www.silicon.co.uk/workspace/malware-data-theft-348010

Taurus Project is a relatively new malware strain that appeared only in the spring of this year.

The malicious ads use the Fallout exploit kit, a popular drive-by hacking toolkit, which tries to install Taurus via vulnerable versions of Internet Explorer or Adobe Flash Player.
Taurus was originally based on another data-stealing malware tool called “Predator the Thief”.

Malwarebytes said it’s becoming increasingly common for malware to combine data theft and the ability to load further malware.
Click to expand...

Malwarebytes: Taurus Project stealer now spreading via malvertising campaign

For the past several months, Taurus Project—a relatively new stealer that appeared in the spring of 2020—has been distributed via malspam campaigns targeting users in the United States. The macro-laced documents spawn a PowerShell script that invokes certutil to run an autoit script ultimately responsible for downloading the Taurus binary.

Taurus was originally built as a fork by the developer behind Predator the thief. It boasts many of the same capabilities as Predator the thief, namely the ability to steal credentials from browsers, FTP, VPN, and email clients as well as cryptocurrency wallets.
Campaign scope
Like the other malvertising campaigns we covered, this latest one is also targeting visitors to adult sites. Victims are mostly from the US, but also Australia and the UK.
Click to expand...

Stealer – loader combo continues to be popular
Stealers are a popular malware payload these days and some families have diversified to become more than plain stealers, not only in terms of advanced features but also as loaders for additional malware.

Even though the threat actors behind Predator the thief have appeared to have handed over a fork of their original creation and disappeared, the market for stealers is still very strong.
Click to expand...

Log in or Sign up

Taurus Project stealer now spreading via malvertising campaign

guest Guest

Log in or Sign up

Taurus Project stealer now spreading via malvertising campaign

guest Guest

Useful Searches