CSBabaCloudBuildBlockStealer is a CyStack-coined identifier
for an @BabaCloud_New-repackaged System_Info.txt shape
that wraps the same four-key Build Path / Build ID /
Build Version / Build Comment body already observed under
the @ft7links / @BRADMAX / @updh1 bare distributions.
The distinguishing feature is a per-line watermark: every
payload line carries a random 4-9-character lowercase
alphabetic token followed by roughly eight spaces before the
canonical Key: Value text. The obfuscation defeats naive
substring-search leak checks - a grep for Build Path: in
isolation cannot extract the field because the substring
never appears at column 0.
Observed inside @BabaCloud_New { <count>+ } Cloud Logs <DD>.<MM>.<YYYY>.7z aggregator packs at
@BabaCloud_New {<seq>} [<CC>]_<IPv4>_<HWIDPFX>_<8-digit>_ <6-digit>/System_Info.txt victim folders. After stripping
the gibberish prefix, the body carries User time (ISO
wall-clock), HWID (MD5-shape hex), PC Name, User Name
(HOSTNAME\USERNAME), CPU, GPU, Memory (GB-suffixed),
OS, Active window, Build Path, Build ID (builder
identifier), Build Version, Build Comment, Admin rights
(true/false), IP, GEO (ISO-2), and Resolution. Field
vocabulary is identical to the sibling CSBuildBlockStealer
layout; only the panel wrapping differs. A trailing
Country : <CC> tag in the Vidar-style spaced-colon form is
sometimes appended after a blank line.
Public reporting attests @BabaCloud_New as a Telegram
cloud-logs operation that has released multiple
thousand-record credential dumps since mid-2025 but does not
explicitly name the underlying panel family for either its
Vidar-shape or BuildBlock-shape distributions. The parallel
Daisy Cloud reseller applies a branded Daisy Private cloud
digit-obfuscated watermark to the same BuildBlock body; the
sibling CSBabaCloudStealer profile covers a Vidar-shape
body from the same @BabaCloud_New operator with distinct
field vocabulary (MachineID : / GUID : / HWID : /
--- [ Hardware ] --- section header). Family stays
CyStack-coined pending a published rebrand mapping.
