en
BRADMAX 3-file cc/cookies/history minimal packcc apostrophe-s pipe-header layoutCSCcApostropheStealer (also known as BRADMAX 3-file cc/cookies/history minimal pack and cc apostrophe-s pipe-header layout) is a CyStack research label for information-stealer traces. CSCcApostropheStealer targets browser credentials, Browser saved credit-card numbers (with expiry and name) and Browser history. As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSCcApostropheStealer is a CyStack-coined identifier for a
minimal three-file victim folder observed inside !! 2025 NOV.part001.rar BRADMAX / @BRADLOGS aggregator packs at
[<TAG>]@BRADLOGS (BRADMAX) (<NN>)/ victim folders. The pack
ships cc's.txt (credit-card listing with apostrophe-s
lowercase naming) plus cookies.txt plus history.txt, and
sometimes an empty-named packer directory artifact. No
companion system-info file, no passwords dump, no token files.
cc's.txt opens with the panel's 5-column pipe-header Name on Card | Expiration Month | Expiration Year | Card Number | Date Modified (double-space-pipe-double-space separators).
Per-card rows follow when the victim had saved cards; victims
with no saved cards produce a header-only file (~89 bytes).
The apostrophe-s filename is the distinguishing feature:
canonical Lumma / Vidar / Redline / StealC /
Phantom-documented credit-card files use cards.txt /
CC.txt / CreditCards.txt, never the cc's.txt form.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and
community catalogues do not document a stealer that emits
exactly this cc's.txt + cookies.txt + history.txt shape
with the pipe-header credit-card file. The column-style
writing pattern is consistent with Stealerium and its forks
(public reporting documents Stealerium and Phantom as one fork
lineage), but no public Stealerium / Phantom analysis attests
the cc's.txt apostrophe filename, so the family attribution
stays unknown.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
