en
@BRADMAX Password.txt 4-line blockBradMax Cloud Soft/Host/Login/PasswordCSSoftHostStealer (also known as @BRADMAX Password.txt 4-line block and BradMax Cloud Soft/Host/Login/Password) is a CyStack research label for information-stealer traces. CSSoftHostStealer targets browser credentials and Mobile-app credentials (`android://...` host scheme entries). As of 11/10/2026, CyStack's research records 1 distribution channel, with unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSSoftHostStealer is a CyStack-coined identifier for a
title-cased Soft: / Host: / Login: / Password: 4-line
credential block observed inside @BRADMAX aggregator-pack
victim folders that ship only a Password.txt with no
companion system-info file. Folder layout in the wild is
[<CC>]@BRADMAX (<N>)/Original/... /Password.txt with a
sibling Smart Checker/ directory that holds post-exfil
credential-validator output.
Public Telegram-channel catalogues label the BRADMAX channel
as a redistributor of "Redline and Raccoon Data Logs", but the
title-cased 4-line block matches neither family canonically.
Redlines native cred output is URL: / Username: / Password: / Application: and Raccoons is a tab-or pipe-separated row
layout; the Soft: keyword with title-case capitalisation
does not appear in either. A public stealer-log format writeup
records this exact 4-line shape as one of five common
credential formats but does not attribute it to a specific
malware family.
Family attribution is provisional pending a published threat-intel mapping for this layout. Public reporting does not document a stealer that emits exactly this title-cased 4-line block. Treat the family attribution as unknown during triage: the aggregator self-label is misleading because the body lacks every canonical anchor for both named families.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel | Confidence |
|---|---|---|
| — | Telegram | Unknown |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
