Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSBrowersStealer Infostealer Analysis: Targets & TTPs

CSBrowersStealer

Also known as:!! 2025 OCT aggregator panel summary

What is the CSBrowersStealer infostealer, and what data does it steal?

CSBrowersStealer (also known as !! 2025 OCT aggregator panel summary) is a CyStack research label for information-stealer traces. CSBrowersStealer targets browser credentials, cryptocurrency wallets, Credit-card data (count flag), Google session artifacts (count, suspected), Twitter/X session artifacts (count, suspected), Facebook session cookies (count flag), Browser extensions (per-victim list) and Installed applications of interest (per-victim list). As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBrowersStealer is a CyStack-coined identifier for a nine-line Information.txt panel summary observed inside !! 2025 OCT.part01.rar-style aggregator packs in <id>_<CC>_<IPv4>_<DD-MM-YY>/Information.txt victim folders (e.g. 1110_CA_<IPv4>_18-10-25/). The body lists IP, Country (flag emoji + ISO code + country name), Username, Antivirus, then four standalone section keys Facebook:, Extensions:, Wallets:, Applications: (each carrying a literal comma-separated value or None), and closes with a pipe-separated count line under the developer-misspelled key Browers: (sic, missing s): CK:<n>|PW:<n>|AF:<n>|CC:<n>|GG:<n>|TT:<n>|FB:<n>|HOST:<bool>. No HWID, hostname, OS, or hardware inventory is shipped, so the artifact is a victim-side fingerprint view rather than a full system-info export.

The CK|PW|AF|CC|FB subset overlaps with the publicly documented PXA Stealer count notation, but the per-section split (standalone Facebook:, Extensions:, Wallets:, Applications: lines rather than the PXA caption single Data Information: line), the Browers: typo, and the GG/TT/HOST:FALSE count columns are not described in any public source. Family attribution is provisional pending a published threat-intel mapping for this exact panel layout.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`5d3e7c5...`	15,869	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence