Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSMainLootStealer Infostealer Analysis: Targets & TTPs

CSMainLootStealer

Also known as:BRADMAX sparkle-banner notification panel@VerifiedThief Telegram-bot Main Loot / Additional Data log

What is the CSMainLootStealer infostealer, and what data does it steal?

CSMainLootStealer (also known as BRADMAX sparkle-banner notification panel and @VerifiedThief Telegram-bot Main Loot / Additional Data log) is a CyStack research label for information-stealer traces. CSMainLootStealer targets browser credentials, cryptocurrency wallets, Messenger sessions (count flag on `💬 Messengers:`), Game launcher credentials (count flag on `🎮 Games:`), Server / FTP / SSH credentials (count flag on `🗄️ Servers:`), Grabbed files (count flag on `🎣 Grabbers:`) and Combined OS username + hostname (user@host on the `💻 User:` line). As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSMainLootStealer is a CyStack-coined identifier for a Telegram-bot-notification Information.txt panel with a ✨ New Log Received ✨ sparkle-bracketed banner. The body ships a 💻 User: <user>@<host> victim-identity line, a 🌍 IP: placeholder, two captioned sections (📊 Main Loot: for passwords / cookies / wallets, 📦 Additional Data: for messengers / games / servers / grabbers), each carrying per-category emoji-prefixed count lines, and a Support: @VerifiedThief admin contact footer. Observed inside !! 2025 NOV.part001.rar BRADMAX aggregator packs at [<TAG>]@BRADLOGS (BRADMAX) (<NN>)/Information.txt victim folders.

A single community source (March 2026) hints at Hexo Stealer attribution for the sparkle-banner + Main Loot + Additional Data notification shape, but the article is paywalled and could not be fetched verbatim. A public Hexon Stealer report documents a related (but distinct) rebrand of Stealit Stealer without publishing the exact notification format. With one unverifiable community source and no confirmation from public research, family attribution stays CyStack-coined.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
—	Telegram	Low

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`1be296d...`	37	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1💻 User: <value>2🌍 IP: <value>3 4📊 Main Loot:5🔑 Passwords: <value>6🍪 Cookies: <value>7💰 Wallets: <value>8 9📦 Additional Data:10💬 Messengers: <value>11🎮 Games: <value>12🗄️ Servers: <value>13🎣 Grabbers: <value>14 15Support: <value>