Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSAppProfileStealer

Also known as:BRADMAX All_Passwords.txt with [Profile:] bracket annotationU+2501-separated Application-Profile cred block

What is the CSAppProfileStealer infostealer, and what data does it steal?

CSAppProfileStealer (also known as BRADMAX All_Passwords.txt with [Profile:] bracket annotation and U+2501-separated Application-Profile cred block) is a CyStack research label for information-stealer traces. CSAppProfileStealer targets browser credentials, Source browser identity (Chrome, Edge, Firefox, Brave, Opera) and Browser profile name (`Default`, named profiles). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSAppProfileStealer is a CyStack-coined identifier for an orphan All_Passwords.txt cred-file shape distributed inside !! 2025 NOV.part001.rar @BRADLOGS / BRADMAX aggregator packs in [<CC>]@BRADLOGS (BRADMAX) (<NN>)/ victim folders where the panel does not ship a companion system-info file. Each saved credential is rendered as a 4-line URL: / Username: / Password: / Application: <Browser> [Profile: <name>] block, with records separated by a 80-character U+2501 ━ HEAVY HORIZONTAL rule line.

The Application: line annotates the source browser and profile in a bracketed form (e.g. Application: Chrome [Profile: Default], Application: Edge [Profile: Default]). A public stealer-log format grammar attests a sibling 4-line shape and notes that URL/Username/Password/Application is Redline-native, but no two independent public sources publish a sample log showing this exact [Profile: <name>] bracket annotation paired with U+2501 separators. Family attribution is provisional pending a published threat-intel mapping for this layout.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
—	Telegram	Unknown

CSAppProfileStealer Infostealer Analysis: Targets & TTPs