Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Ottoman Stealer Malware Analysis: Targets & TTPs

CSOttomanPanelStealer

Also known as:Ottoman CloudOttoman StealerOttoman Stealer v2.0

What is the CSOttomanPanelStealer infostealer, and what data does it steal?

CSOttomanPanelStealer (also known as Ottoman Cloud, Ottoman Stealer and Ottoman Stealer v2.0) is a CyStack research label for information-stealer traces. CSOttomanPanelStealer targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, Documents matching the file-grabber filter list, Browser history, bookmarks, extensions and Credit card data stored in browsers. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with low attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSOttomanPanelStealer is a CyStack-coined identifier for the Ottoman aggregator panel's Information.txt shape. Ottoman, self-styled as Ottoman Cloud or Ottoman Stealer v2.0, is a paid log-distribution service that resells stealer logs through the Telegram ecosystem. Per the operator's own marketing site at ottomancloud.github.io, the service compiles harvested data from multiple source stealers, normalises the output to a unified Information.txt shape, and sells 1500 to 5000 records per day across tiered subscription plans ($75 to $600 per month).

The Ottoman panel appears in community catalogs but no public research publishes a primary analysis of the panel format. The operator admits Ottoman runs over multiple source malware families (Redline, MetaStealer, Raccoon, AuraStealer, TitanStealer, Vidar), so the underlying family on any given victim varies. The CS prefix marks the label as CyStack-coined; the panel brand Ottoman and the operator support handle @OttoSup are preserved as taxonomy fields.

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Panel name	Distribution channel	Confidence
ot********	Telegram	Low

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`1f914ef...`	160	Low

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

CSOttomanPanelStealer

What is the CSOttomanPanelStealer infostealer, and what data does it steal?

Description

Operator panels & distribution channels

Accelerate investigation with professional monitoring solutions

Data is masked to protect the community

MITRE ATT&CK technique mapping

Variants (1)

Data limited to 5 variants

Common field keys

Sample log format