en
CSGeoSysInfoStealer is a CyStack research label for information-stealer traces. CSGeoSysInfoStealer targets browser credentials, IP and geo fingerprint and System hardware and OS inventory. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSGeoSysInfoStealer is a CyStack-coined identifier for
a single-section === SYSTEM INFO === system.txt panel
distributed through the @BRADMAX Telegram channel.
The body carries 8 flat Key: Value lines under one
triple-equals header: Computer, User, OS, IP,
Country, CPU, GPU, RAM. Hardware fields are
present but typically empty on observed bodies; the
OS value is the literal placeholder Windows 10/11
rather than a real version string.
The format shares the === SYSTEM INFO === header with
CSStatsSectionStealer but ships an
entirely different field set and no second STATS
section. Same operator channel @BRADMAX but a
different builder.
1 distinct distribution channel recorded for this malware
| Panel name |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Distribution channel |
|---|
| Confidence |
|---|
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
bfb272d... | 2 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Computer: <value>User: <value>OS: <value>IP: <value>Country: <value>CPU:GPU:RAM:
