CSForzaTrafficStealer is a CyStack tracking name for an
observed Info.txt layout. The retained body identifies
CLÓUD CHANNEL - @forza_traffic and
SUPPORT - @ez_sources; its archive provenance carries the
separate @FORZATRAFFICx handle in
MIX_LOGS_<NNNN>_BONUS_UPDATE_@FORZATRAFFICx_<Month>_<YYYY>_part<N>.rar packs. These labels establish
distribution provenance, not a canonical malware-family
attribution.
After the banner, the device-information block shares a
verbose bare Key: Value vocabulary with
CSRoyCloudInfoStealer and CSSigInfoStealer. Stable fields
cover build and execution context, privilege state, host and
user identity, OS and language, install and system time,
antivirus, HWID, CPU, GPU, RAM, and display resolution.
The observed body has neither the (sig:UNIX.HEX) footer of
CSSigInfoStealer nor the RÔýĆløud wrapper of
CSRoyCloudInfoStealer. Its <CC>_<32-hex>/Info.txt folder
name contains a country-code token and an opaque identifier,
not an IP address or timestamp. Log time is derived from the
System Date and Time Zone body fields; IP and country stay
unset unless explicit fields are present.
No defensible public mapping currently ties this exact layout
to a canonical builder, so attribution remains a CyStack
tracking name.
