Threat reportMalwareTL-2026-3862
GlorySprout Stealer - C++ infostealer, modified clone of Taurus Stealer, sold on XSS forum
GlorySprout Stealer (TL-2026-3862), also tracked as GlorySprout Stealer, is a medium-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1027.007), and is covered by 9 detection rules and 20 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-3862
- Threat ID
- TL-2026-3862
- Also known as
- GlorySprout Stealer
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, cryptocurrency
- Target regions
- Global (excluding CIS countries)
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in GlorySprout Stealer
Malware and tooling: GlorySprout, HEUR:Trojan-PSW.Win32.Stealer.gen, Predator The Thief, Schtasks, Taurus Stealer, Trojan:Win32/Predator.SN!MTB, Win32:CrypterX-gen [Trj]
How GlorySprout Stealer works
GlorySprout is a C++ information stealer advertised on the XSS forum in March 2024 for $300 (with crypting and loader options). Analysis assesses it as a modified clone of Taurus Stealer with a Golang panel and SQL back-end. It steals browser credentials, crypto wallets and Steam/Telegram/Discord sessions, persists via a scheduled task, and talks to its C2 over HTTP port 80 using RC4+Base64.
GlorySprout appeared on the XSS forum in March 2024 as a commercial malware-as-a-service style stealer priced at $300, bundled with a 20-day crypting service and a loader option. RussianPanda's analysis assesses it as a modified (and in the author's words, failed) clone of Taurus Stealer, a stealer that appeared in spring/June 2020 as a fork by the developer behind Predator the Thief. The control panel is written in Golang with an SQL back-end (uses sqlx) and still contains references to 'taurus'. It has a loader module, Anti-CIS execution, log backup, country/IP blocking and a Grabber module reported as non-functional. Compared with Taurus it lacks keylogging and the remote DLL dependency downloads; anti-VM is a configurable option but reportedly inconsistently implemented (one secondary source states there are no anti-VM protections).
The stealer is written in C++ and keeps its configuration in a binary resource section. It uses API hashing (multiplication, addition, XOR and bit-shift operations) and XOR/arithmetic string obfuscation, and resolves APIs dynamically from system libraries such as shell32.dll and user32.dll. It performs language identifier checks to avoid CIS systems. Persistence is achieved with a scheduled task created through schtasks/cmd.exe that runs the dropped payload from %TEMP% under a random 8-character filename (when the loader module is active). The task name is reported as 'WindowsDefenderUpdater' in the mirror of the original research and as '\WindowsDefender\Updater' in secondary reporting; hunt on both. The task name imitates Microsoft Defender.
It collects browser credentials, cookies and card data, cryptocurrency wallets, Steam, Telegram and Discord sessions and other application data from %AppData%. PCrisk's write-up (19 March 2024) adds device profiling (CPU, GPU, RAM, screen size, username, IP address), screenshot capture, and targeting of wallets such as MetaMask, Phantom and Ledger (plus 19 others), Chrome/Firefox/Edge/Opera browsers, Outlook, FTP and VPN clients, and Steam/Battle.net; that list comes from a removal-guide source and was not independently confirmed in the technical analysis. Browser passwords are decrypted server-side. Stolen data is compressed into ZIP archives (reported as encrypted with the first 10 bytes of the encrypted BotID string) and sent by HTTP POST over port 80 with RC4+Base64, using a hardcoded Chrome-like user-agent. Observed endpoints are /cfg/data=<botid> (check-in), /log/ (exfiltration) and /loader/complete/?data=1 (loader completion notice). A flawed randomization function (fixed seed 0xC40DF552) yields a static key, IDaJhCHdIlfHcldJ; the sources differ on whether this string is the RC4 key or the (encrypted) BotID from which the key is derived. Because the key is static, defenders can decrypt captured traffic and build network signatures.
Antivirus engines classify samples generically (Microsoft: Trojan:Win32/Predator.SN!MTB, Kaspersky: HEUR:Trojan-PSW.Win32.Stealer.gen, Avast: Win32:CrypterX-gen [Trj]), consistent with the Predator/Taurus code lineage. Distribution is not documented in the primary analysis; PCrisk lists generic vectors (malspam, malvertising, cracks) without sample-level evidence. Severity is an analyst assessment; no CVE, CVSS or KEV entry exists. No actor attribution beyond the forum seller is stated in the sources.
MITRE ATT&CK techniques used in TL-2026-3862
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1036.004 Masquerading: Masquerade Task or Service; T1497.001 Virtualization/Sandbox Evasion: System Checks
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1132.001 Data Encoding: Standard Encoding; T1573.001 Encrypted Channel: Symmetric Cryptography
Discovery
T1082 System Information Discovery; T1614.001 System Location Discovery: System Language Discovery
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Affected products and versions in GlorySprout Stealer
- Microsoft — Windows
Vulnerable versions: Windows endpoints (no specific versions stated in sources)
Remediation for GlorySprout Stealer
Immediate actions
- Block C2 IPs 147.78.103.197 and 45.138.16.167 at the perimeter
- Hunt for scheduled tasks named WindowsDefenderUpdater or \WindowsDefender\Updater and for executables with random 8-character names in %TEMP%
- Alert on HTTP POST to /cfg/data=, /log/ and /loader/complete/?data=1 on port 80
- Reset credentials and revoke Steam, Telegram and Discord sessions and crypto wallet secrets on any affected host
Workarounds
- Restrict user ability to create scheduled tasks under misleading Windows Defender names
- Block execution from %TEMP% and %AppData% with application control
Longer-term hardening
- Deploy EDR with behavioral detection for schtasks-created persistence spawning cmd.exe from user-writable paths
- Restrict outbound cleartext HTTP from workstations and enforce web proxy inspection
- Use hardware-backed or managed credential storage instead of browser password stores
Timeline of GlorySprout Stealer
- Taurus Stealer, the family GlorySprout is assessed to clone, is first observed (spring/early June 2020) as a fork by the developer behind Predator the Thief; Zscaler and Infoblox publish analyses in June 2020.
- Taurus shifts to malvertising distribution in late August 2020 (exact day not stated; ThreatDown reports the Fallout exploit kit chain and Taurus loading SystemBC and QBot).
- ThreatDown/Malwarebytes publishes 'Taurus Project stealer now spreading via malvertising campaign', documenting Taurus C2 111.90.149.143 and malvertising infrastructure.
- GlorySprout is advertised on the XSS forum (March 2024; exact day not stated) for $300 with a 20-day crypting service and loader option.
- Analysis shows a flawed randomization function with fixed seed 0xC40DF552 produces a static key (IDaJhCHdIlfHcldJ) for RC4+Base64 C2 traffic, enabling traffic decryption and signaturing.
- RussianPanda publishes 'The GlorySprout or a Failed Clone of Taurus Stealer', documenting C++ internals, scheduled-task persistence, the /cfg/data=, /log/ and /loader/complete/ endpoints, and C2 IPs 147.78.103.197 and 45.138.16.167.
- PCrisk publishes a removal guide for GlorySprout listing AV detections (Microsoft Trojan:Win32/Predator.SN!MTB, Kaspersky HEUR:Trojan-PSW.Win32.Stealer.gen, Avast Win32:CrypterX-gen [Trj]) and targeted wallets, browsers and applications.
- Cyber Security News reports on GlorySprout being advertised on hacking forums (March 2024; exact day not stated), citing the Taurus-clone assessment and the '\WindowsDefender\Updater' task.
Sources cited for GlorySprout Stealer
- The GlorySprout or a Failed Clone of Taurus Stealer (mirror of RussianPanda research)
- Hackers Advertising GlorySprout Stealer On Popular Hacking Forums
- Removal instructions for the Glorysprout stealer-type malware (PCrisk)
- Taurus: The New Stealer in Town (Zscaler)
- New Malware Variant: Project Taurus Infostealer Follows in Predator the Thief's Footprints (Infoblox)
- Taurus Project stealer now spreading via malvertising campaign (ThreatDown/Malwarebytes)
- An In-Depth analysis of the new Taurus Stealer (Outpost24)
- Threat Hunting Content: Taurus Stealer Detection (SOC Prime)
Detection coverage for TL-2026-3862
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3862 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.