en
CSStealerCloudUserInfoStealer is a CyStack research label for information-stealer traces. CSStealerCloudUserInfoStealer targets browser credentials, Victim locale (keyboard language, display resolution) and Victim geo (country, region, city, postal code, timezone) plus IPv4 / IPv6 address. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with low attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSStealerCloudUserInfoStealer is a CyStack-coined identifier
for the STEALERCLOUD broker's UserInformation.txt shape:
three flush-left Key: Value identity lines at the top
(Keyboard Language:, Display Resolution:, an @stealerboss - Buy daily fresh logs: operator banner with a wallpaper-name
value), then a centered IP GEOLOCATION DATA ASCII section
header, then six geo fields (IP Address:, Country: <Name> (<ISO2>), Region:, City:, Postal Code:, Timezone: <IANA-tz> (<UTC-offset>)). The IP Address: slot accepts
both IPv4 and IPv6.
Same broker as CSHardwareTailStealer: the STEALERCLOUD
aggregator pack splits the victim summary across two files,
with the YAML hardware tail in Info.txt and the locale plus
geo identity in UserInformation.txt. The @STEALERBOSS
Telegram channel handle is the distribution channel. No public
reporting attributes either file shape to a specific
source-stealer family, so attribution is provisional pending a
public writeup.
1 distinct distribution channel recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name | Distribution channel | Confidence |
|---|---|---|
| st******** | Telegram | Low |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
8e55366... | 1 | Low |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
Keyboard Language: <value>Display Resolution: <value> IP Address: <value>Country: <value>Region: <value>City: <value>Postal Code: <value> Timezone: <value>
