CSMatchesFilterStealer is a CyStack-coined identifier for a
four-line Information.txt written by a Telegram broker bot
that pre-scans the victim's harvested cookies and passwords
for high-value domain or keyword hits, then rolls the
per-target counts into a single Matches: line so prospective
buyers can rank logs before purchase. The body is IP: /
Country: / User: / Matches:, no banner, no section
dividers, no trailing footer. The Country: value follows the
dual-token ISO2 - Name form (BD - Bangladesh), which is
the format's narrowest disambiguator across flat-key shapes.
The format is a broker-side caption rather than a stealer
family's own writer output, so the underlying family for any
given log is not recoverable from this panel alone: multiple
stealers can feed into the broker's pre-scan pipeline. The
Matches: enrichment list (per-domain or per-keyword counts)
is panel-side metadata, not victim-side data, so it is
intentionally not retained as victim observables. Observed targets in
the rollup line include freelancer / payment platforms
(payoneer.com, upwork.com, gumroad.com), social-network
accounts (facebook.com, studio.youtube.com), and free-form
financial keywords (bank, payout).
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and the
public stealer-format catalogues do not document a family that
emits this exact four-line IP / Country / User /
Matches: shape.
