Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSFlatMacBradmaxStealer Infostealer Analysis: Targets & TTPs

CSFlatMacBradmaxStealer

Also known as:Flat macOS system_profiler panel (aggressive collapse)BRADMAX macOS Information.txt with space-collapsed keys

What is the CSFlatMacBradmaxStealer infostealer, and what data does it steal?

CSFlatMacBradmaxStealer (also known as Flat macOS system_profiler panel (aggressive collapse) and BRADMAX macOS Information.txt with space-collapsed keys) is a CyStack research label for information-stealer traces. CSFlatMacBradmaxStealer targets macOS full user name plus short login (dscl format), Apple product line and model identifier (MacBookPro, Mac Studio, iMac, etc.) plus model number, Apple Silicon chip name or Intel processor name, Total core count with performance/efficiency split (Apple Silicon hybrid core report), Physical memory in GB, Hardware UUID (SPHardwareDataType canonical field), Provisioning UDID (Apple Configurator supervision identifier), GPU chipset model, vendor, Metal support version, Display resolutions with aspect-ratio annotations (2560x1080 UW-UXGA UltraWide, etc.) and Secure Virtual Memory / SIP status flags. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSFlatMacBradmaxStealer is a CyStack-coined identifier for an aggressive-collapse BRADMAX-repackaged macOS system_profiler Information.txt panel where every whitespace between adjacent fields has been dropped, including inside multi-word key names. Canonical macOS-stealer keys Model Name:, Chipset Model:, Total Number of Cores:, Hardware UUID:, Provisioning UDID:, Activation Lock Status:, Metal Support:, Model Identifier:, and Model Number: all appear as space-collapsed variants (ModelName:, ChipsetModel:, TotalNumberofCores:, etc.). Values are glued to keys without whitespace (Memory:16GB, ModelIdentifier:Mac14,9), producing a two-physical-line body that concatenates the entire SPHardwareDataType and SPDisplaysDataType output.

Observed inside @BRADMAX 12000 FEB-MARCH.part1.rar at @BRADMAX <count> <MONTHS>/[<CC>]<IPv4>/ Information.txt victim folders. The observed sample is an Italian-locale macOS victim (Time since boot: 23 ore e 4 minuti collapsed to Timesinceboot: 23oree4minuti), Apple Silicon M2 Pro chip, MacBook Pro model.

This layout is distinct from the sibling CSFlatMacProfilerStealer, where each field occupies its own line and multi-word keys retain spaces. Here, substring matches on collapsed keys plus BRADMAX archive context distinguish the aggressive-collapse variant.

Family attribution is provisional pending a published threat-intel mapping. Multiple canonical macOS stealer families (AMOS / Atomic, Banshee, Cthulhu, Poseidon, MacSync) shell out to the same system_profiler subcommands per public writeups. Without a family-specific banner surviving in this aggressive-collapse panel, attribution to any single canonical family is a guess. Rename the CyStack tracking name if a public writeup later publishes a sample of this exact aggressive-collapse variant.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
—	Telegram	Low

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`decc88b...`	1	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1IP:<value>2Username:<value>3Password:<value>4Software:5SystemSoftwareOverview:6BootVolume:<value>7BootMode:<value>8UserName:<value>9SecureVirtualMemory:<value>10SystemIntegrityProtection:<value>11Timesinceboot:<value>12Hardware:13HardwareOverview:14ModelName:<value>15ModelIdentifier:<value>16ProcessorName:<value>17ProcessorSpeed:<value>18NumberofProcessors:<value>19TotalNumberofCores:<value>20L2Cache(perCore):<value>21L3Cache:<value>22Hyper-ThreadingTechnology:<value>23Memory:<value>24SMCVersion(system):<value>25SerialNumber(system):<value>26HardwareUUID:<value>27ProvisioningUDID:<value>28Graphics/Displays:29IntelIrisPro:30ChipsetModel:<value>31Type:<value>32Bus:<value>33Vendor:<value>34DeviceID:<value>35RevisionID:<value>36MetalFamily:<value>37Displays:38ColorLCD:39DisplayType:<value>40Resolution:<value>41FramebufferDepth:<value>42MainDisplay:<value>43Mirror:<value>44Online:<value>45AutomaticallyAdjustBrightness:<value>46ConnectionType:<value>