CSBrowserFingerprintStealer

Also known as:

What is the CSBrowserFingerprintStealer infostealer, and what data does it steal?

CSBrowserFingerprintStealer is a CyStack research label for information-stealer traces. CSBrowserFingerprintStealer targets Browser fingerprint signals from Chromium-based browsers, Embedded-Chromium fingerprint signals from Electron apps, Gaming-platform Chromium installs (Riot Client, TapTapGlobal) and Chromium settings used to score / spoof victim profiles. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSBrowserFingerprintStealer is a CyStack-coined identifier for a per-application Chromium fingerprint grabber shipping <App>_[<HEX4>].txt per-instance fingerprint dumps inside a Browser/Fingerprint/ subfolder. Each dump carries an INI-section body: [Local State], [Preferences], [Metadata] plus an epoch Extraction Time: field. The grabber targets every Chromium-based desktop install on the victim, not just browsers: Chrome / Edge / Discord / Riot Client / G HUB / TapTapGlobal / embedded Chromium caches such as CefBrowserCache and webcache2 all get their own dump.

Observed inside an APRIL 30 - 12068 LOGS aggregator pack that also carries macOS SHub Stealer victims, so this is the Windows-victim shape within the same distribution pipeline. The field set overlaps the documented ChromElevator (xaitax / Chrome-App-Bound- Encryption-Decryption) --fingerprint mode, but ChromElevator emits JSON output rather than the INI-section text observed here. Family attribution is provisional pending a published mapping for this layout.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence