CSMacBareGeoStealer is a CyStack-coined identifier for a bare
2-line geo header macOS panel observed inside !! 2025 DEC.part01.rar aggregator packs at
[<CC>]<IPv4>/UserInformation.txt victim folders. The body
opens with just IP: <ipv4> and Country: <full English name> on two lines, then drops into the verbatim
system_profiler SPSoftwareDataType / SPHardwareDataType /
SPDisplaysDataType output. No banner, no Country Code:
line, no Region: / City: / lat / lon / Zipcode: /
Timezone: fields, no BuildID: per-build label, no
MetaMask Info: / Debanks: / Userinfo: section markers,
no self-banner.
The 2-line geo header is the panel's minimal-extraction quirk.
Documented macOS stealers either ship a richer geo block
(Cthulhu's 9-field block, AMOS's 3-field block) or serialise
system info to JSON (Banshee). The flat-key text shape plus
the missing country-code sibling field rules out all four
registered macOS formats (Cthulhu, MacSync, AMOS,
CSMacUserinfo).
Family attribution is provisional. Public reporting and the
public stealer-format catalogues do not document a macOS
family that emits this exact bare 2-line geo +
system_profiler shape. Public coverage of macOS stealers
focuses on Cthulhu, AMOS, Banshee, Poseidon / Odyssey, and
DigitStealer, but none of those writeups publish a sample
matching this layout.
