Taurus: The New Stealer in Town

This report analyzes the "Taurus" info‑stealer (attributed to the Predator the Thief group) observed in June 2020: phishing emails with malicious Word macros download an AutoIt interpreter and encoded scripts from GitHub, decode and inject shellcode into dllhost.exe, perform anti-sandbox checks, steal browser credentials, cookies, crypto wallets, FTP/email/app credentials and system data, compress results in-memory and exfiltrate to XORed C2 endpoints; the report includes technical details, MITRE ATT&CK mappings, and IOCs (file hashes, domains, and an IP for the attacker panel).