Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

CSSnatchCloudXFilesStealer

Also known as:@SNATCH_CLOUDSNATCH CLOUDXFiles space-strippedDeerStealer

What is the CSSnatchCloudXFilesStealer infostealer, and what data does it steal?

CSSnatchCloudXFilesStealer (also known as @SNATCH_CLOUD, SNATCH CLOUD, XFiles space-stripped and DeerStealer) is a variant of an information-stealing malware family. CSSnatchCloudXFilesStealer targets browser credentials, cryptocurrency wallets, Host identity and operating-system metadata, System hardware (CPU, GPU, RAM, display resolution) and Running-process enumeration. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

CSSnatchCloudXFilesStealer is a CyStack tracking name for the @SNATCH_CLOUD reseller's space-stripped XFiles Information.txt, shipped alongside the reseller's Redline UserInformation.txt, macOS Information.txt, and sig-info Info.txt siblings inside <DD.MM> @SNATCH_CLOUD <count>K.part<N>.rar aggregator packs at <CC><32-char-token>_<ISO8601-with-spaces>/ Information.txt victim folders. The body carries the full XFiles-canonical field vocabulary (OperationID concatenated UUID identifier, IP, Country:<CC> (<verbose>) nested-paren country, OperatingSystem, Username, ComputerName, HardwareID 40-hex, CPU(Processor), GPU(DisplayDevices), RAM(Memory), Screens, DesktopScreenshotTaken, WindowsProcesses [ process list) plus the panel's official support URLs (t.me/xfiles_support_official, t.me/XFILESDevBlog) and the luciferxfiles@exploit.im Jabber actor email documented in Zscaler's X-FILES analysis. Every whitespace separator inside both keys and values is stripped by the reseller (Operation ID: → OperationID:, Hardware ID: → HardwareID:, CPU (Processor): → CPU(Processor):, Country: BD (Bangladesh) → Country:BD(Bangladesh)), differing from canonical XFiles only in that collapse.

Family attribution is canonical XFiles at high confidence: the body's two XFiles self-identifiers (the luciferxfiles@exploit.im actor email and the xfiles_support_official support channel URL) are documented by Zscaler and ANY.RUN as XFiles-canonical. HEROIC Threat Intelligence documents @SNATCH_CLOUD as a dedicated Telegram reseller releasing 18,561-record stealer-log breach dumps, which the panel-brand overlay reflects.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

1 distinct distribution channel recorded for this malware

Panel name	Distribution channel	Confidence
sn********	Telegram	High

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`98ef1bd...`	1	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence