en
AL StealerCSALStealer (also known as AL Stealer) is a variant of an information-stealing malware family. CSALStealer targets browser credentials, cryptocurrency wallets and Minecraft account credentials and Hypixel Skyblock data. As of 11/10/2026, CyStack's research records 1 variant distributed through 1 channel, with medium attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSALStealer is a CyStack-coined identifier for a self-named
AL Stealer log family observed inside APRIL 25 - 19966 LOGS
Telegram packs in DZ_<IP>_<DD-MM-YY>/ victim folders. The
format is Lumma-shaped (dash-prefix YAML list) but carries a
distinct build banner, a different distribution channel, and
lacks Lumma's canonical (sig:UNIX.HEX) signature. The
malware self-identifies as AL Stealer (likely "Additional
Libraries", matching its Telegram channel) and targets
Hypixel Skyblock players via fake Minecraft mods. Family
identification is provisional; no published threat-intel
source attests this specific log template, hence the CS
prefix.
1 distinct distribution channel recorded for this malware
| Panel name | Distribution channel |
|---|
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Confidence |
|---|
| al******** | Telegram | Medium |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
acc2678... | 26 | Medium |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
# Join now: <value> - OS Version: <value>- Local Date: <value>- Time Zone: <value>- Install Date: <value>- Computer: <value>- User: <value>- Domain: <value>- Hostname: <value>- Anti Virus:- HWID: <value>- RAM Size: <value>- CPU Vendor: <value>- CPU Name: <value>- CPU Threads: <value>- CPU Cores: <value>- GPU: <value>- Display resolution: <value> - Clipboard: <value>
