Taurus Project stealer now spreading via malvertising campaign
For the past several months, Taurus Project—a relatively new stealer that appeared in the spring of 2020 —has been distributed via malspam campaigns targeting users in the United States . The macro-laced documents spawn a PowerShell script that invokes certutil to run an autoit script ultimately responsible for downloading the Taurus binary. Taurus was originally built as a fork by the developer behind Predator the thief . It boasts many of the same capabilities as Predator the thief, namely the ability to steal credentials from browsers, FTP, VPN, and email clients as well as cryptocurrency wallets. Starting in late August, we began noticing large malvertising campaigns , including, in particular, one campaign that we dubbed Malsmoke that distributes Smoke Loader. During the past few days we observed a new infection pushing the Taurus stealer. Campaign scope Like the other malvertising campaigns we covered, this latest one is also targeting visitors to adult sites. Victims are mos
