CSBradMaxAgentIdMacStealer is a CyStack-coined identifier
for a banner-stripped macOS Information.txt panel
distributed through the @BRADMAX Telegram log-reseller
channel (distinct from the sibling @BRADMAX_CLOUD
reseller). Observed inside @BRADMAX <N> <MONTH>.part<N> .rar aggregator packs at [<CC>]<IPv4>/Information.txt
victim folders.
The body opens with the === System Info === triple-equals banner (shared with canonical SHub
Stealer) but
drops the SHub Stealer self-identification literal that
SHub bodies carry on the second line. A Build Tag: <short-tag> identifier line and an External IP: +
Country: geo pair follow, then a second System Info
section header, a Username: line, and the distinctive
Agent ID: <16-hex> per-victim session identifier.
Device identity carries Hostname: (macOS Bonjour
<name>.local), OS Version: as bare semantic version
(e.g. 14.5.0 with no macOS prefix), Timezone: as an
IANA tz-database identifier (Europe/Zagreb), and
Languages: as a JSON array string of BCP-47 locales
(["de-AT"]). A terse Hardware: block with four
4-space-indented children follows: GPU:, CPU Cores:,
RAM: <N> GB, Screen: <WxH>.
The field set diverges sharply from every registered
macOS stealer: SHub, Phexia, MacSync / mac.c, Cthulhu,
AMOS, Banshee, and Odyssey all ship the verbose
system_profiler SPSoftwareDataType /
SPHardwareDataType / SPDisplaysDataType output with
System Software Overview / Hardware Overview /
Model Name / Model Identifier / Chip /
Total Number of Cores / Memory / Hardware UUID /
Serial Number / Chipset Model field wrappers. The
terse four-field Hardware: block here indicates a
lightweight custom harvester rather than a
system_profiler pipe. The Agent ID: plaintext line
with a 16-hex-lowercase value is not observed in any
documented macOS stealer format; closest analogs are
the Odyssey hidden .botid config file and build-header
identifiers embedded in Atomic macOS Stealer samples,
neither of which matches the plaintext field shape.
Family attribution stays CyStack-coined (Case C) pending
a published mapping. A multi-vendor curated CTI survey
(SentinelOne Labs, Malwarebytes, Jamf Threat Labs, CIS,
Moonlock Lab, Huntress, Red Canary, Check Point Research,
Elastic Security Labs, Cyfirma, Censys, BleepingComputer
research, Dark Reading, Help Net Security, Datadog
Security Labs, Microsoft TI, Cookie Engineer, PCRisk)
does not document the shape; community catalogues
(MalBeacon what-is-this-stealer, deepdarkCTI,
RussianPanda) also do not attest it. HEROIC darkhive-breaches attests the @BRADMAX
distributor at multiple pack entries separately from
the @BRADMAX_CLOUD sibling.
