CSBrowserProfileStealer is a CyStack-coined identifier for a
Logins.txt cred-file shape observed inside @BRADMAX 14000 MARCH.part01.rar Telegram aggregator packs at
[<CC>]<IPv4>/Logins.txt victim folders (e.g. @BRADMAX 14000 MARCH/[CO]<IPv4>/Logins.txt). The body ships 4-line
Key: Value blocks in the sequence URL: / Username: /
Password: / Browser: separated by =============== (15+
equals signs).
The distinctive Browser: fourth label carries a concatenated
<UPPERCASE-BROWSER-NAME>_<Profile> value (e.g.
CHROME_Default, EDGE_Profile 1, FIREFOX_ default-release). The underscore-joined form marks this shape
apart from every sibling 4-line cred-block convention in the
registry: Redline uses Application: as the fourth label,
CSAppProfileStealer uses Application: <Browser> [Profile: <name>] bracket annotation, CSLoginsPathStealer uses
Application: Browser/Logins/<Browser>_<Profile>[<hex>].txt
path notation, and CSUrlUserPassFromStealer uses short
labels plus From: <BareBrowserName>.
Family attribution is provisional pending a published
threat-intel mapping for this exact serialisation. Public
reporting and community catalogues do not attest a family
emitting this exact Browser: <NAME>_<Profile> fourth-label
shape.
