CSMultiAppCredBundleStealer

Also known as:Multi-app credentials bundleCloud + VPN + FTP + chat + gaming loot bundle

What is the CSMultiAppCredBundleStealer infostealer, and what data does it steal?

CSMultiAppCredBundleStealer (also known as Multi-app credentials bundle and Cloud + VPN + FTP + chat + gaming loot bundle) is a CyStack research label for information-stealer traces. CSMultiAppCredBundleStealer targets Steam/Telegram/Discord session tokens, Cloud provider credentials (AWS access key + secret from ``~/.aws/credentials`` dropped under ``Azure/``), Password manager vaults (Bitwarden), VPN configurations and credentials (OpenVPN, ProtonVPN), FTP client credentials (FileZilla sitemanager.xml, FTPGetter, TotalCommander wcx_ftp.ini) and Remote-desktop session identifiers (AnyDesk). As of 11/10/2026, CyStack's research assesses unknown attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSMultiAppCredBundleStealer is a CyStack-coined identifier for a per-victim application-loot bundle observed inside the 16,17 APRIL - 27206 LOGS.part01.rar aggregator pack at <32-char alphanumeric>_<TIMESTAMP>/ victim folders. The pack ships an 11-application subdirectory tree covering the credential-manager, VPN, FTP, chat, cloud, and gaming application slots that stealer families commonly harvest: AnyDesk, Azure, Bitwarden, Discord, FileZilla, FTPGetter, OpenVPN, ProtonVPN, Steam, Telegram, TotalCommander.

The Azure/credentials filename is a panel mislabel: the file body is a boto-style AWS credentials INI file (with [default] block, aws_access_key_id, aws_secret_access_key), not an Azure resource-manager token file. The stealer's harvest routine likely grabbed %USERPROFILE%\.aws\credentials and dropped it under an Azure/ subdir because both cloud vendors share the "cloud" category slot in the panel harvest configuration. Multiple stealer families target subsets of this application set (Redline, Vidar, Lumma, StealC, Meta all harvest FileZilla / Discord / Telegram / Steam), so the underlying harvester could be any of them. Family attribution is provisional pending a published threat-intel mapping.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

What is the CSMultiAppCredBundleStealer infostealer, and what data does it steal?

Description

Accelerate investigation with professional monitoring solutions

MITRE ATT&CK technique mapping