CSFacebookProfileStealer is a CyStack-coined identifier for a
Facebook-account-profile summary that the @ft7links-lumma
panel writes into a file named System.txt instead of
canonical stealer system info. Each line uses a U+2013 en-dash
(not the ASCII hyphen-minus) as the prefix glyph and lists
four fields lifted directly from the Facebook Graph API:
Friends (account friend count), Business (Business Manager
flag), Marketplace (Marketplace access flag), and Country
(Facebook account country, empty for bogon-IP victims where
the panel could not resolve geo-IP).
The format matches what public reporting documents for
NodeStealer 2.0 and for SYS01 stealer (both query the Facebook
Graph API after exfiltrating a session cookie to enumerate
friends count, business-account flag, and account country),
but no public writeup shows a sample log with this exact
en-dash-prefixed label set, so the format-to-family mapping
remains provisional and the CS prefix is retained pending a
published confirmation. This catalog retains the structure as a labeling-only profile: country and the tracking label are recoverable, while the available evidence does not support a stronger family attribution.
