CSEmojiInfoStealer is a CyStack-coined identifier for a
nineteen-line Information.txt panel summary where every
visible field carries a leading Unicode emoji glyph, observed
inside !! 2025 OCT.part01.rar-style aggregator packs in
<id>_<CC>_<IPv4>_<DD-MM-YY>/Information.txt victim folders
(e.g. 1121_CH_<IPv4>_18-10-25/). The body opens with a
three-line victim header (🖥️ User:, 🌐 IP:, 📋 OS Name:
carrying Python's platform.platform() dash-joined string),
six single-line counts (🍪 Cookies:, 🔒 Passwords:, 📖 History:, 📚 Bookmarks:, 📦 Extensions:, 💳 Cards:), and
closes with three free-form section blocks (📁 Other applications:, 💸 Crypto wallets:, 📝 Grabbed files:) that
use the literal placeholders No wallets found and No grabbed files found when empty.
The platform.platform() OS-string format points at a
Python-built grabber, and the emoji-on-every-field convention
plus the 📝 Grabbed files: section header is the panel's
developer-side quirk. Family attribution is provisional
pending a published threat-intel mapping for this exact field
set. The closest documented relative is PupkinStealer, which
also uses emoji-prefixed fields but ships a different label
set (🔸 PC:, 🆔 SID:, 🔐 Found passwords:, 📷 Screenshot:,
📂 Desktop files:) and a Coded by Ardent watermark not seen
here.
