en
CSBrowserCategoryDumpStealer is a CyStack research label for information-stealer traces. CSBrowserCategoryDumpStealer targets browser credentials, Browser history, bookmarks, downloads, Saved credit card data and Browser extensions inventory. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSBrowserCategoryDumpStealer is a CyStack-coined identifier
for a per-victim per-browser category dump layout shipping
under [<32-hex>]/Browser/<BrowserName>/ leaf folders. Each
leaf carries Pascal-case category files (Autofill.txt,
Passwords.txt, Cookies.txt, History.txt,
Bookmarks.txt, CreditCards.txt, Downloads.txt,
Extensions.txt). Each file body opens with a triple-equals
ALL-CAPS section header mirroring the category name
(Autofill.txt body opens with === AUTOFILL ===), then a
blank line, then one or more key: value records separated by
50-character dashed lines.
The 32-hex MD5 victim-folder convention matches
CSTikTokAccountStealer and CSNetflixCookiesStealer, confirming a shared
MAY 02 - 8230 LOGS2 distribution pipeline. The leaf folder
names span Chromium-derived browsers (Chrome / Edge / Brave /
Opera / EpicPrivacyBrowser / Vivaldi / Yandex / CocCoc /
Maxthon / Comodo Dragon). Family attribution is provisional
pending a published mapping for this exact layout.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
