Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSMacUserinfoStealer Infostealer Analysis: Targets & TTPs

CSMacUserinfoStealer

Also known as:Bare macOS userinfo.txt panelNo-BuildID Cthulhu-shape macOS log

What is the CSMacUserinfoStealer infostealer, and what data does it steal?

CSMacUserinfoStealer (also known as Bare macOS userinfo.txt panel and No-BuildID Cthulhu-shape macOS log) is a CyStack research label for information-stealer traces. CSMacUserinfoStealer targets macOS hardware fingerprint (Hardware UUID, Model Identifier, Chip / Processor), macOS account inventory (Computer Name, User Name), macOS version and kernel build (System Version, Kernel Version), Public-IP geolocation (country, city, latitude / longitude, zipcode, timezone) and Display configuration (Chipset Model, VRAM, resolution). As of 11/10/2026, CyStack's research records 1 variant, with unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSMacUserinfoStealer is a CyStack-coined identifier for a macOS info-stealer that writes a bare userinfo.txt (lowercase) with a 9-field IP geolocation header followed directly by the verbatim system_profiler output for the SPSoftwareDataType, SPHardwareDataType, and SPDisplaysDataType sections. The file ships no operator banner, no BuildID: per-build label, and no MetaMask Info: / Debanks: / Userinfo: panel section headers. Observed inside !! 2025 JULY.part001.rar aggregator packs in <CC><31-alnum>_<ISO timestamp with microseconds>/userinfo.txt victim folders.

The layout overlaps the publicly documented Cthulhu Stealer Userinfo.txt shape but two structural details rule out a direct Cthulhu attribution. First, BuildID: is absent. Cthulhu always emits the line carrying its operator-set per-build label, so an unsigned variant is undocumented. Second, the Region: value uses the IP2Location-style Dubayy spelling for Dubai instead of ipinfo.io's Dubai form; Cthulhu uses ipinfo.io as its geo source. Family attribution is provisional pending a published threat-intel mapping for this layout.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`ab5581a...`	1	Unknown

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1IP: <value>2Country: <value>3Country Code: <value>4Region: <value>5City: <value>6Latitude: <value>7Longitude: <value>8Zipcode: <value>9Timezone: <value>10 11Software:12 13    System Software Overview:14 15      System Version: <value>16      Kernel Version: <value>17      Boot Volume: <value>18      Boot Mode: <value>19      Computer Name: <value>20      User Name: <value>21      Secure Virtual Memory: <value>22      System Integrity Protection: <value>23      Time since boot: <value>24 25Hardware:26 27    Hardware Overview:28 29      Model Name: <value>30      Model Identifier: <value>31      Model Number: <value>32      Chip: <value>33      Total Number of Cores: <value>34      Memory: <value>35      System Firmware Version: <value>36      OS Loader Version: <value>37      Serial Number (system): <value>38      Hardware UUID: <value>39      Provisioning UDID: <value>40      Activation Lock Status: <value>