CSRFDStealer is a CyStack-coined identifier for an
emoji-prefixed FileGrabber/UserInformation.txt shape
distributed through the @BRADMAX_CLOUD redistributor
portfolio. The file opens with a canonical <================[ User Info ]>================> section header followed by an
operator tag literal <================RFD================>
on the next line, then a blank line, then a 17-line
emoji-prefixed <emoji> <Key>: <Value> field block.
Field values place the runtime in JavaScript / Node.js: Type: Windows_NT is os.type(), Arch: x64 is os.arch(),
Release: 10.0.19044 is os.release(), Processors: <count>
is os.cpus().length. The label flip between Host name
(which carries the canonical computer name from
os.hostname()) and PC Name (which carries the Windows
account name from process.env.USERNAME) is consistent with a
NodeJS or Electron stealer template. The body matches
structural features of the documented NodeJS / Electron
stealer category (NOVABLIGHT, Celestial Stealer, Mercurial),
but no public reporting quotes a field-layout match for this
exact layout, so family attribution is provisional.
