CSEvelatedTypoInfoStealer

Also known as:Is Evelated typo stealerGraphical Adapter dual-GPU stealer

What is the CSEvelatedTypoInfoStealer infostealer, and what data does it steal?

CSEvelatedTypoInfoStealer (also known as Is Evelated typo stealer and Graphical Adapter dual-GPU stealer) is a CyStack research label for information-stealer traces. CSEvelatedTypoInfoStealer targets Host OS and hardware fingerprint (CPU, GPU with duplicate ``Graphical Adapter`` label, screen resolution, HWID), Geo enrichment (IP, country, city, ZIP, timezone with operator-side default timezone-city annotation), Account identity (Windows username, machine name), Current clipboard content at capture time (crypto addresses, magnet links, other high-value clipboard data) and Installed software inventory and running process list. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSEvelatedTypoInfoStealer is a CyStack-coined identifier for an Information.txt panel with the distinctive Is Evelated: typo (sic, Evelated not Elevated) admin-flag field. Observed inside the 28 APRIL - 37817 LOGS2.part01.rar aggregator pack at [<panel-tag>] <CC>_<IPv4>/<CC>_<IPv4>_<DDMMYYYY>_<HH>_<MM>_<SS>/ Information.txt victim folders where the parent folder prefix uses a [<panel-tag>] marker like [login.live] that identifies the victim category (browser sign-in tag, filesharing tag, etc.).

Field vocabulary is Redline-lineage (File Location:, HWID:, Machine Name:, Username:), but the distinctive Is Evelated: typo combined with paired GPU: + Graphical Adapter: duplicate fields (both carrying the same adapter query result under two labels), plus Screen Resolution: (not Display Resolution:), Keyboard Layout: singular (not Keyboard Languages: plural), and a Clipboard Text: raw-clipboard-content field, makes it a private fork or niche family whose fingerprint has not been mapped publicly. The 2022-02-26 log timestamp on observed samples suggests an older builder whose panel-format research pre-dates current public reporting. Family attribution is provisional pending a published threat-intel mapping.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

What is the CSEvelatedTypoInfoStealer infostealer, and what data does it steal?

Description

Accelerate investigation with professional monitoring solutions

MITRE ATT&CK technique mapping