CSFacebookMarketStealer is a CyStack-coined identifier for a
Facebook-account-resale marketplace listing emitted as
Information.txt inside !! 2025 NOV.part001.rar @BRADLOGS / BRADMAX aggregator packs. Per-victim folders follow the
[<TAG>]@BRADLOGS (BRADMAX) (<NN>)/ layout. The body is a
four-line record: a 15-digit Facebook user ID plus display
name plus date of birth header, a crown emoji pricing tier
line, a related-pages line, and a raw Facebook session cookie
string carrying c_user, xs, datr, sb, fr, ps_l,
ps_n, wd.
The pricing-tier line uses U+1F451 👑 followed by a U+2219
∙ BULLET OPERATOR separator chain that carries asking price
(with U+1F4B6 💶 euro-banknote suffix), age and ratio stats,
trading currency, ISO 3166 country code, a TS[<n>-<m>]
trust-score bracket, and a U+2119 ℙ category flag. The body
is most likely a panel-side post-processing artifact where a
raw stealer cookie dump has been converted into a resale
listing for an underground Facebook account marketplace.
Family attribution is provisional pending a published
threat-intel mapping for this layout. The closest documented
relatives are NodeStealer, SYS01, and the public
Facebook-Profile-Stealer write-ups: each collects the c_user
and xs cookie pair from Facebook accounts, but none
publishes a sample log showing this exact emoji-tagged
marketplace listing shape.
