en
@ft7links geo-box variantCSGeoBoxStealer (also known as @ft7links geo-box variant) is a variant of an information-stealing malware family. As of 11/10/2026, CyStack's research assesses high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSGeoBoxStealer is a CyStack-coined identifier for a no-banner
@ft7links UserInformation.txt variant containing an
═══ IP GEOLOCATION DATA boxed enrichment block. Observed in
the same folder layout as CSEnchantCloudStealer (channel-banner
variants) and the RedlineLikeStealer DARKSIDE-banner variants,
but this rebrand strips the panel banner entirely and replaces
the identity preamble with a box-drawing geolocation block.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
