en
CashFlow Premium CloudC4SHFL0W PR3M1UM CL0UDCSCashFlowStealer (also known as CashFlow Premium Cloud and C4SHFL0W PR3M1UM CL0UD) is an aggregate profile of information-stealer traces. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSCashFlowStealer is a CyStack-coined identifier for the
heavily-stripped CashFlow Premium Cloud System.txt log
observed inside @ft7links-distributed packs alongside the
CSArtHouseCloudStealer distribution. The body wraps the same
XFiles-derivative victim-info block as CSArtHouseCloudStealer
but uses a different distributor's banner. The
@HUNTER_CLOUDS support handle in the footer and the
t.me/Link_CashFlow channel reference identify the
distribution path.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
