CSNetflixCookiesStealer is a CyStack-coined identifier for a
Netflix account-checker aggregator output folder. The
per-victim folder is a 32-hex MD5 wrapped in brackets
([<md5>]) and ships a single Cookies/ subdirectory with
one .txt file per valid Netflix session. Each filename packs
five bracket-delimited segments encoding the account state:
subscription plan, historical payment count, Extra-members
add-on flag, ISO 3166 alpha-2 country code, and the login
email. The body is split into an en-dash-prefixed enrichment
header (– Email:, – Plan:, – Country:, – Payments:,
etc.) and Netscape-format cookies for .netflix.com carrying
the session-cookie set (NetflixId, SecureNetflixId,
dsca, nfvdid).
The cred files reference https://russia34.com as the
upstream raw-cookie source (a Telegram stealer aggregator that
CSRussia34Stealer already handles for the sibling
UserInformation.txt shape) and the @logslead operator
footer as the Netflix-checker tool that processed the russia34
cookies into per-account enriched dumps. The same LOGS2
distribution pipeline also carries TikTok-account harvest
folders represented by CSTikTokAccountStealer and 4-category
Windows-victim folders represented by
CSCommonFilesCategoryStealer. Family attribution is
provisional pending a published mapping for this
Netflix-checker tool.
