CSBracketVendorCardsStealer is a CyStack-coined identifier for
a CreditCards/ victim-folder layout that ships one cred file
per Chromium-based browser vendor / profile combination,
naming each file after the AppData/Local vendor subdirectory
in square brackets. Observed inside !! 2025 JUNE.part001.rar
at CreditCards/ CreditCards_[AVAST Software]_Default.txt,
CreditCards_[BraveSoftware]_Default.txt, and
CreditCards_[Microsoft]_Default.txt siblings.
The bracketed-vendor tokens ([AVAST Software],
[BraveSoftware], [Microsoft], [Google], [Yandex],
etc.) are literal copies of the subdirectory names under
AppData/Local/<Vendor>/ where Chromium-derivative browsers
keep their User Data tree. The stealer reads each browser's
Web Data SQLite credit_cards table and writes one file per
source profile. The cred-file body uses Exp: <MM/YYYY> for
expiry. Many files are minimal (expiry-only, ~12 bytes)
because the panel app-bound-encryption bypass returned the
encrypted PAN but could not decrypt it on Chrome builds
shipping hardware-bound session keys.
A public stealer-log format writeup documents the sibling
Autofills/Google_[Chrome]_Default.txt /
Autofills/Microsoft_[Edge]_Default.txt bracketed-vendor
convention as a generic Chromium-credential-extract shape used
by multiple stealers (RedLine, META, Raccoon, Stealc appear in
the same article), but does not pin the
CreditCards_[<Vendor>]_<Profile>.txt shape to a named
family. Family attribution is provisional pending a published
threat-intel mapping for this layout.
