CSGADSPanelStealer is a CyStack-coined identifier for a
compact five-line Information.txt panel summary observed
inside !! 2026 JAN.part01.rar-style aggregator packs in
[CC]<IPv4>/Information.txt victim folders. The body lists
IP, Country (flag emoji + ISO code + country name), User,
AntiVirus, and a Browser Data: count line in pipe-separated
PXA-style notation:
CK:<n>|PW:<n>|AF:<n>|CC:<n>|FB:<n>|GADS:<bool>. No HWID,
hostname, OS, or hardware inventory accompanies the summary,
so the panel is a victim-side fingerprint view rather than a
full system-info export.
The CK|PW|AF|CC|FB count abbreviations are publicly
documented as the PXA Stealer data-tracker format, and the
[CC]<IP> folder convention matches the PXA panel
exfiltration shape ([CC_IPADDRESS]_HOSTNAME.zip). The
attribution is suggestive but not definitive: PXA's documented
victim-side system_info.txt uses a verbose
Vietnamese-headered Thông tin hệ thống block of WMI
snake_case keys, as documented in the PXA profile, and the trailing
GADS (Google Ads account flag) column plus the bare
AntiVirus: line are not described in any public reporting.
The format may be a panel-summary view from a PXA log-ingest
pipeline or an unrelated Telegram aggregator that adopted the
PXA count notation.
Family attribution is provisional pending a published
threat-intel mapping for this exact panel-summary layout.
