CSCardTargetStealer is a CyStack-coined identifier for a
4- or 5-line CN/DATE/NAME/TARGET[/CVV] credit-card
cred-file shape distributed inside @BRADLOGS / BRADMAX
aggregator packs. Observed in !! 2025 NOV.part001.rar
at [<TAG>]@BRADLOGS (BRADMAX) (<NN>)/CreditCards/ CC_Edge_Profile <N>.txt and in the sibling
!! 2025 MARCH.part001.rar packs at
[<TAG>]@MAXERSTE (@BRADMAX) (<NN>)/CreditCards/ CC_Chrome_Profile <N>.txt victim folders. Each cred
file holds exactly one card record in a per-browser-profile split (50-80 byte file size), so a typical
victim folder ships multiple CC_<Browser>_Profile 1.txt / 2.txt / 3.txt files alongside any saved-card variants from other browser profiles.
The label sequence in uppercase casing
(CN: / DATE: / NAME: / TARGET: and an optional
CVV:) is the disambiguating signal. CN: is short
for card number (16-digit PAN), DATE: carries the
expiry in M/YYYY or MM/YYYY form, NAME: is the
cardholder name (frequently empty when the browser
stored only the number), TARGET: is the merchant or
website where the card was used, and the optional
CVV: is the 3-digit security code. The panel drops
the CVV: line entirely when the browser stored only
the PAN and expiry, producing a 4-line block ending at
TARGET:. Family attribution is provisional pending a
published threat-intel mapping for this layout. The
format is distinct from the Millenium RAT
CreditCards.txt (Browser/Name/Number/Expire
labels with the ------ Credit Cards ------ banner) and from the canonical PXA Stealer credit-card dump (per-browser JSON in the PXA Telegram
captions).
