CSSoftUrlPassStealer is a CyStack-coined identifier for a
Passwords.txt-shaped block-record file mis-routed to the
System.txt slot inside <N> LOGS.rar aggregator packs.
Observed inside 4 APRIL - 2950 LOGS.rar at
JM[<HWID>][<TIMESTAMP>]/System.txt victim folders where
the pack builder wrote per-victim credentials under a
System.txt basename rather than the canonical
Passwords.txt.
The body is a block-record format with four line-anchored
fields per record in fixed order: SOFT: (browser
identifier, Chrome Profile <N> (<version>)), URL:
(login origin, HTTPS or Android autofill
android://<b64hash>@<pkg>/), USER: (account handle),
and PASS: (stored credential). Records are separated by
blank lines. The SOFT/URL/USER/PASS block layout is common
across multiple stealers per a public stealer-log format
writeup (one of five documented Passwords.txt shapes) and
cannot be uniquely mapped to a specific underlying builder
from format alone. Family attribution is provisional pending a
published threat-intel mapping for this specific mis-routing
pattern.
