CSUrlUserPassFromStealer is a CyStack-coined identifier for a
4-line URL / User / Pass / From cred-file shape distributed
inside 202605080230_@BRADMAX 11700 MAY.part1.rar aggregator
packs at [<ISO2>]<IPv4>/Passwords.txt victim folders. The
folder ships a minimal 2-file layout (Bookmarks.txt +
Passwords.txt) with no companion system-info file. The cred
file body holds short-label URL: <url>, User: <username>,
Pass: <password>, From: <Browser> lines, one block per
entry; observed samples ship a single 83-byte block per
victim.
The short labels (URL / User / Pass) distinguish this
format from sibling 4-line shapes: Redline,
CSAppProfileStealer, CSDateCreatedStealer,
CSLoginsPathStealer, and CSDbscProtectedStealer all use
the long-form URL: / Username: / Password: labels. The
From: <Browser> fourth label, carrying a bare browser-name
word, replaces the Application: line those sibling shapes
use. A public Zaraza Bot writeup documents an Edge-targeting
Telegram-distributed builder that harvests origin_url /
username_value / password_value to an output.txt cred
file, but does not publish the exact serialised label
sequence, so attribution stays CyStack-coined pending a
published mapping for this exact shape.
