en
CSBrowsersDisplayStealer is a CyStack research label for information-stealer traces. CSBrowsersDisplayStealer targets browser credentials and Display info or screenshot. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSBrowsersDisplayStealer is a CyStack-coined identifier for
the most-stripped BRADMAX-redistributed per-victim folder
layout: a root with exactly two named subdirs, Browsers/ and
Display/, optionally with a packer empty-name DIR sibling.
Cred files live under Browsers/<browser>/Passwords.txt with
a simple three-line URL: / Login: / Password: block per
credential. No Information.txt, no System.txt, no
Cookies/ or Wallets/ sibling dirs.
The 2-dir layout sits below the 4-dir
Browsers/Discord/Files/System layout that
is represented by CSBradmaxCategoryStealer. The underlying builder is
unidentified from the root listing alone: BRADMAX
redistribution strips per-builder branding before repacking.
Family attribution is provisional pending a published mapping
for this exact layout.
1 distinct distribution channel recorded for this malware
| Panel name |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Distribution channel |
|---|
| Confidence |
|---|
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
