en
JSON cookies-only bundleCookie-Editor export format cookies bundle_json.txt suffix per-profile cookie bundleCSJsonCookiesOnlyStealer (also known as JSON cookies-only bundle, Cookie-Editor export format cookies bundle and _json.txt suffix per-profile cookie bundle) is a CyStack research label for information-stealer traces. CSJsonCookiesOnlyStealer targets browser credentials. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSJsonCookiesOnlyStealer is a CyStack-coined identifier for
a LOGS2-pack per-victim folder-style IOC shipping a minimal
cookies/ subdirectory with JSON-array cookie exports
(the Cookie-Editor / EditThisCookie extension format used
by many post-processing tools). Observed inside the
23-24 JUNE - 25597 LOGS2.part01.rar aggregator pack at
<CC>- -<HWID>-<TIMESTAMP>/ victim folders where the
folder name uses the same space-padded convention as the
sibling CSExceptionCookiesOnly LOGS-pack variant.
The per-profile cookie file uses a
<Browser>_<Profile>_json.txt filename with the _json
infix, and the body is a JSON array of cookie objects with
domain / expirationDate / httpOnly / name /
path / secure / value keys. The stealer likely
uses a Chromium Cookies SQLite export routine that
serialises directly to JSON rather than to the Netscape
flat-file layout. Family attribution is provisional pending
a published threat-intel mapping.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
