Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSCommonFilesCategoryStealer

Also known as:

What is the CSCommonFilesCategoryStealer infostealer, and what data does it steal?

CSCommonFilesCategoryStealer is a CyStack research label for information-stealer traces. CSCommonFilesCategoryStealer targets browser credentials, Harvested user documents from Downloads / Documents folders, Directory listings from the victim's drives, System info: hostname, IP, hardware fingerprint, installed software and Desktop screenshot (per-monitor, numbered `Display (N).png`). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSCommonFilesCategoryStealer is a CyStack-coined identifier for a Windows-victim folder layout shipping a four-directory category split inside a per-victim folder named [<IPv4>]-<HOSTNAME>. The four root subdirectories are Common Files, Credentials, Directories, and System, with a Display (N).png screenshot at root and an optional packer empty-name DIR sibling. Common Files carries the FileGrabber output (harvested user docs from Downloads / Documents), Credentials ships the stealer-emitted credential dumps, Directories carries walked-directory listings, and System carries the text system-info dumps.

Observed inside MAY 02 - 8230 LOGS2 aggregator packs that also carry the TikTok-account harvest folders represented by CSTikTokAccountStealer. The category naming is the panel's undocumented builder choice rather than a documented stealer convention. Family attribution is provisional pending a published mapping for this layout.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence