en
CSStealerCloudInfoStealer is a CyStack research label for information-stealer traces. CSStealerCloudInfoStealer targets Victim GPU model (from WMI `Win32_VideoController`) and Victim display resolution (from WMI `Win32_DisplayMonitor`). As of 11/10/2026, CyStack's research records 2 variants distributed through 1 channel, with low attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSStealerCloudInfoStealer is a CyStack-coined identifier for
the STEALERCLOUD broker's third file shape: a stripped 2-field
Information.txt containing just a GPU: line and a
Displays: (plural) line with multi-space value padding after
each colon. The body carries no banner, no operator handle,
and no other fields. Same STEALERCLOUD panel brand and
@STEALERBOSS distribution channel as CSHardwareTailStealer
(Info.txt YAML hardware tail) and
CSStealerCloudUserInfoStealer (UserInformation.txt locale +
geo block); the broker ships per-victim context split across
three filename shapes.
The stripped 2-field form likely reflects a fallback path the
broker takes when no canonical source-stealer panel was
available, falling back to a bare Win32 WMI
Win32_VideoController + Win32_DisplayMonitor enumeration.
Family attribution is provisional pending a public writeup.
1 distinct distribution channel recorded for this malware
| Panel name |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Distribution channel |
|---|
| Confidence |
|---|
| st******** | Telegram | Low |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
2 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
1bdd89b... | 298 | Low |
37cf42d... | 1,862 | Low |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Category: <value>Build ID: <value>Username: <value>Computer: <value>HWID: <value>IP: <value>Country: <value>Path: <value> Category: <value>OS: <value>Language: <value>System: <value>Keyboards: <value>Local Time: <value>UTC Time: <value>Timezone: <value> Category: <value>CPU: <value>Cores/Threads: <value>RAM: <value>GPU: <value>Displays: <value>
