CSWifiBackslashNStealer is a CyStack-coined identifier for a
minimal two-file victim folder observed inside !! 2025 NOV.part001.rar BRADMAX / @BRADLOGS aggregator packs at
[<TAG>]@BRADLOGS (BRADMAX) (<NN>)/ victim folders. The pack
ships only installed_apps.txt plus wifi_passwords.txt (and
sometimes an empty-named packer directory artifact); no
companion system-info file, no browser-credential dump, no
token files.
The wifi cred file is one physical line at the OS level. The
panel serialises per-SSID entries with the literal
two-character \n escape (backslash + n) as the separator,
not real LF. Per-entry shape is <SSID> | <password>\n; open
networks and browser-sync placeholders emit <SSID> | \n with
the password segment blank.
Family attribution is provisional pending a published
threat-intel mapping for this layout. Public reporting and
community catalogues do not document a family that emits
exactly this 2-file minimal layout. The pipe-delimited <SSID> | <password> body itself is a generic netsh wlan show profile name=<x> key=clear post-processing shape used by many
.NET and Python stealer builders, so the literal \n
serialisation plus the 2-file root layout is what gives this
label its specificity.
