en
CSApplicationsDiscordStealer is a CyStack research label for information-stealer traces. CSApplicationsDiscordStealer targets Discord session tokens and Other Chromium-Electron desktop app session tokens (potentially shipped under `Applications/<App>/Tokens.txt`). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSApplicationsDiscordStealer is a CyStack-coined identifier
for a per-victim folder shipping a single Applications/
subdirectory with per-application token harvests inside a
[<ISO2>]<IPv4> parent folder. Each app under Applications/
carries its own Tokens.txt file (e.g.
Applications/Discord/Tokens.txt for Discord auth tokens).
The Discord file body carries one token per line: the leading
base64 segment encodes the user's Discord snowflake ID,
followed by dotted timestamp / signature parts (3-part form
for standard auth tokens, 2-part for refresh / MFA tokens).
Observed inside MAY 02 - 8230 LOGS aggregator packs (the LOGS sibling of LOGS2 also associated with CSCookiesSoftStealer). Same [<ISO2>]<IPv4> parent-folder
convention, but a different categorical subdir name
(Applications/ vs Soft/) and a different per-app harvest
convention (Discord auth tokens vs Steam JWT sessions). Family
attribution is provisional pending a published mapping for
this exact layout.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
