MALWARE FAMILY

Taurus Stealer

Internal ID: win.taurus_stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to Zscaler, Taurus is a stealer that surfaced in June 2020. It is being developed by the author(s) that previously created Predator the Thief. The name overlaps partly with the StealerOne / Terra* family (also aliased Taurus Loader) but appears to be a completely disjunct project.

Threat Analysis

Taurus Stealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.minerva-labs.com/taurus-stealers-evolution

→https://blog.morphisec.com/google-ppc-ads-deliver-redline-taurus-and-mini-redline-infostealers

→https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/Additional%20Analysis/UnknownTA/2020-09-07/Analysis.md

→https://go.recordedfuture.com/hubfs/reports/cta-2022-0802.pdf

→https://outpost24.com/blog/an-in-depth-analysis-of-the-new-taurus-stealer/

→https://www.aon.com/cyber-solutions/aon_cyber_labs/agentvx-and-taurus/

→https://www.blueliv.com/cyber-security-and-cyber-threat-intelligence-blog-blueliv/an-in-depth-analysis-of-the-new-taurus-stealer/

→https://www.secureworks.com/research/the-growing-threat-from-infostealers

→https://www.zscaler.com/blogs/research/taurus-new-stealer-town

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.taurus_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Taurus Stealer