# GlorySprout Stealer - C++ infostealer, modified clone of Taurus Stealer, sold on XSS forum

> GlorySprout is a C++ information stealer advertised on the XSS forum in March 2024 for $300 (with crypting and loader options). Analysis assesses it as a modified clone of Taurus Stealer with a Golang panel and SQL back-end. It steals browser credentials, crypto wallets and Steam/Telegram/Discord sessions, persists via a scheduled task, and talks to its C2 over HTTP port 80 using RC4+Base64.

- **Published:** 2026-10-19T07:23:38Z
- **Last reviewed:** 2026-10-19T07:23:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3862
- **ID:** TL-2026-3862
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GlorySprout appeared on the XSS forum in March 2024 as a commercial malware-as-a-service style stealer priced at $300, bundled with a 20-day crypting service and a loader option. RussianPanda's analysis assesses it as a modified (and in the author's words, failed) clone of Taurus Stealer, a stealer that appeared in spring/June 2020 as a fork by the developer behind Predator the Thief. The control panel is written in Golang with an SQL back-end (uses sqlx) and still contains references to 'taurus'. It has a loader module, Anti-CIS execution, log backup, country/IP blocking and a Grabber module reported as non-functional. Compared with Taurus it lacks keylogging and the remote DLL dependency downloads; anti-VM is a configurable option but reportedly inconsistently implemented (one secondary source states there are no anti-VM protections).

The stealer is written in C++ and keeps its configuration in a binary resource section. It uses API hashing (multiplication, addition, XOR and bit-shift operations) and XOR/arithmetic string obfuscation, and resolves APIs dynamically from system libraries such as shell32.dll and user32.dll. It performs language identifier checks to avoid CIS systems. Persistence is achieved with a scheduled task created through schtasks/cmd.exe that runs the dropped payload from %TEMP% under a random 8-character filename (when the loader module is active). The task name is reported as 'WindowsDefenderUpdater' in the mirror of the original research and as '\WindowsDefender\Updater' in secondary reporting; hunt on both. The task name imitates Microsoft Defender.

It collects browser credentials, cookies and card data, cryptocurrency wallets, Steam, Telegram and Discord sessions and other application data from %AppData%. PCrisk's write-up (19 March 2024) adds device profiling (CPU, GPU, RAM, screen size, username, IP address), screenshot capture, and targeting of wallets such as MetaMask, Phantom and Ledger (plus 19 others), Chrome/Firefox/Edge/Opera browsers, Outlook, FTP and VPN clients, and Steam/Battle.net; that list comes from a removal-guide source and was not independently confirmed in the technical analysis. Browser passwords are decrypted server-side. Stolen data is compressed into ZIP archives (reported as encrypted with the first 10 bytes of the encrypted BotID string) and sent by HTTP POST over port 80 with RC4+Base64, using a hardcoded Chrome-like user-agent. Observed endpoints are /cfg/data=<botid> (check-in), /log/ (exfiltration) and /loader/complete/?data=1 (loader completion notice). A flawed randomization function (fixed seed 0xC40DF552) yields a static key, IDaJhCHdIlfHcldJ; the sources differ on whether this string is the RC4 key or the (encrypted) BotID from which the key is derived. Because the key is static, defenders can decrypt captured traffic and build network signatures.

Antivirus engines classify samples generically (Microsoft: Trojan:Win32/Predator.SN!MTB, Kaspersky: HEUR:Trojan-PSW.Win32.Stealer.gen, Avast: Win32:CrypterX-gen [Trj]), consistent with the Predator/Taurus code lineage. Distribution is not documented in the primary analysis; PCrisk lists generic vectors (malspam, malvertising, cracks) without sample-level evidence. Severity is an analyst assessment; no CVE, CVSS or KEV entry exists. No actor attribution beyond the forum seller is stated in the sources.

## MITRE ATT&CK

- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.007 Obfuscated Files or Information: Dynamic API Resolution
- T1036.004 Masquerading: Masquerade Task or Service
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1614.001 System Location Discovery: System Language Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1113 Screen Capture
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1132.001 Data Encoding: Standard Encoding

## Sources

- [The GlorySprout or a Failed Clone of Taurus Stealer (mirror of RussianPanda research)](https://www.hendryadrian.com/?p=9390)
- [Hackers Advertising GlorySprout Stealer On Popular Hacking Forums](https://cybersecuritynews.com/hackers-glorysprout-stealer-advertising/amp/)
- [Removal instructions for the Glorysprout stealer-type malware (PCrisk)](https://pcrisk.com/removal-guides/29406-glorysprout-stealer)
- [Taurus: The New Stealer in Town (Zscaler)](https://www.zscaler.com/blogs/security-research/taurus-new-stealer-town)
- [New Malware Variant: Project Taurus Infostealer Follows in Predator the Thief's Footprints (Infoblox)](https://www.infoblox.com/blog/threat-intelligence/new-malware-variant-project-taurus-infostealer-follows-in-predator-the-thiefs-footprints/)
- [Taurus Project stealer now spreading via malvertising campaign (ThreatDown/Malwarebytes)](https://www.threatdown.com/blog/taurus-project-stealer-now-spreading-via-malvertising-campaign/)
- [An In-Depth analysis of the new Taurus Stealer (Outpost24)](https://outpost24.com/?p=4002)
- [Threat Hunting Content: Taurus Stealer Detection (SOC Prime)](https://socprime.com/de/blog/threat-hunting-content-taurus-stealer-detection/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3862