en
_info.json snake_case panelCSInzExtStealer (also known as _info.json snake_case panel) is a CyStack research label for information-stealer traces. CSInzExtStealer targets browser credentials, Windows machine identity (SID, machine UUID) and System hardware and locale inventory. As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSInzExtStealer is a CyStack-coined identifier for a
snake_case _info.json panel observed inside
!! 2025 NOV.part001.rar-style aggregator packs in
<id>_<CC>_<IPv4>_<DD-MM-YY>/<HOST>$<USER>_<YYMMDD>_ <HHMMSS>/ per-victim folders. The body is a single flat
JSON object with eleven keys: channel, pc_name,
pc_login, pc_info, path, uuid, sid,
inz_ext_count, python, timestamp, client_utc.
The panel self-identifies as Python-built: pc_info
carries Python's platform.platform() dash-joined
string (Windows-<release>-<build>-<service_pack>) and
python is the absolute path to the interpreter that
produced the log (e.g. C:\Users\<u>\AppData\Local\ Programs\Python\Python3127\python.exe). The channel
value is an alphanumeric campaign / builder code (first
observed literal A7-574) the operator uses to retag
each victim - it is an internal campaign id rather than
a Telegram handle. The inz_ext_count key is the panel-unique marker; the inz_ prefix is unusual and reads as
the panel author's shorthand for an installed-extension
or inzip-extension counter. Family attribution is
provisional pending a published threat-intel mapping for
this layout. The Python-runtime self-reference suggests
a relative of the Vietnamese-speaking-actor cluster
around PXA, Braodo, and Lone None, but none of those
families publishes this exact JSON schema.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
c52c47c... | 295 | Unknown |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
{ "channel": <value>, "pc_name": <value>, "pc_login": <value>, "pc_info": <value>, "path": <value>, "uuid": <value>, "sid": <value>, "inz_ext_count": <value>, "python": <value>, "timestamp": <value>, "client_utc": <value>}
