en
.B.A.B.A.Baba LogsCSBabaStealer (also known as .B.A.B.A. and Baba Logs) is a variant of an information-stealing malware family. As of 07/11/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
CSBabaStealer is a CyStack-coined identifier for a self-named
.B.A.B.A. Lumma-rebrand System.txt log observed inside
@ft7links-distributed packs alongside canonical Lumma content.
The @ft7links operator labels the archive lumma and ships
both genuine Lumma logs and this Lumma-shaped rebrand under one
cover.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
| b.******** |
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Telegram |
| High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
63cd49f... | 365 | High |
# Buy Now Logs : <value># Buy Now ULP : <value>Configuration :- Path:- OS Version:- Local Date : <value> - Time Zone: <value>- Install Date:- Elevated:- Computer: <value>- User: <value>- Domain:- Hostname:- NetBIOS:- Language: <value>- Anti Virus:- HWID: <value>- RAM Size:- CPU Vendor:- CPU Name:- CPU Threads:- CPU Cores:- GPU:- Display resolution:- IP Address:- Country: <value> - Time: <value>- LID: <value>
