CSWLFRCloudStealer is a CyStack-coined identifier for the WLFR
Cloud (@WichLoveFromR) panel layout. The format is a
banner-watermarked lowercase-terse Info.txt: a leading The Best fresh logs and ULP Cloud banner, three repeated
t.me/WichLoveFromR channel handle lines, a Reserve Link: https://linktr.ee/WLFRcloud advertising line, a Buy: @AltairSupport support handle line, and a flat lowercase
key: value block of date / path / country / os / version / language / domain / cpu / ram / gpu fields. All field keys
are lowercase, no leading dash, no banner header above the
block.
The panel routinely emits several fields blank (the observed
sample has empty os / domain / cpu / ram / gpu) and
parks the full OS string under version: instead of os:.
There is no IP address field at all, only a country code,
which is unusual across the surveyed stealer panels and is a
strong distinguishing feature on its own. The date: value is
a bare dd.mm.yyyy with no time component.
Family attribution is provisional pending a published
threat-intel mapping for this lowercase-terse layout. Public
research on stealer-log Telegram clouds documents the WLFR
Cloud / @WichLoveFromR channel as a stealer-log distribution
cloud, but none of those writeups attribute the specific
lowercase-terse panel layout to a known underlying builder. A
community stealer-format catalogue identifies the same
channel's XFiles-shaped redistribution branch (documented separately by the XFiles profile) but does not document
this distinct lowercase format. The CSWLFRCloudStealer tracking name preserves the discovery and can be revised if published evidence later establishes the underlying family.
