en
CSCCsHistoryStealer is a CyStack research label for information-stealer traces. CSCCsHistoryStealer targets Browser saved credit cards (Chromium `Web Data` SQLite `credit_cards` table dump) and Browser history. As of 11/10/2026, CyStack's research assesses unknown attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CSCCsHistoryStealer is a CyStack-coined identifier for a
stripped 2-file per-victim folder shipping just cc's.txt (a
pipe-separated credit-card table) and history.txt (browser
history dump) inside a 32-hex MD5 wrapped-in-brackets parent
folder. The cc's.txt body opens with a five-column header
Name on Card | Expiration Month | Expiration Year | Card Number | Date Modified mirroring the Chromium Web Data
SQLite credit_cards table columns. The Date Modified 5th
column is the panel's distinguishing serialisation choice over
canonical Raccoon / Redline / Stealc card formats.
Observed inside MAY 02 - 8230 LOGS aggregator packs (the LOGS sibling of LOGS2). The 32-hex MD5 parent convention matches
the same family of aggregator layouts. Family attribution is
provisional pending a published mapping for this exact layout.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
