CSFacebookProfileStealer is a CyStack-coined identifier
for a Facebook-account-profile summary that the
@ft7links-lumma panel writes into a file named
System.txt instead of canonical stealer system info.
Each line uses a U+2013 en-dash (not the ASCII hyphen-minus)
as the prefix glyph and lists four fields lifted directly
from the Facebook Graph API: Friends (account friend
count), Business (Business Manager flag), Marketplace
(Marketplace access flag), and Country (Facebook account
country, empty for bogon-IP victims where the panel could not
resolve geo-IP).
The format matches what Palo Alto Unit 42 documents for
NodeStealer 2.0 and what Morphisec documents for SYS01
stealer (both query the Facebook Graph API after exfiltrating
a session cookie to enumerate friends count, business-account
flag, and account country), but neither vendor publishes a
sample log showing this exact en-dash-prefixed label set, so
the format-to-family mapping remains provisional and the
CS prefix is retained pending a curated-CTI confirmation.
The parser is registered late as a labeling parser: it emits
a minimal IOC (country plus the family label) so the
strict-mode "no family parser claimed system file content"
alert stops firing on every per-victim copy of the format
across the parent log pack.
Also known as: NodeStealer (provisional), SYS01 (provisional)
Variants observed: 1
Top attribution confidence: low
Operator panel brands: U+2013 EN-DASH prefix Facebook profile
Distribution channels: @ft7links
- Facebook session cookies and account credentials
- Facebook Business Manager and ads account access
- Facebook Marketplace listing access
- Facebook account profile metadata (friends count, country)
Fingerprint id: u_2013_en_dash_prefix_facebook_profile
Distribution channel: @ft7links
Attribution confidence: low
Filenames: System.txt
Sample (sanitized):
Simple Checker
– ID: 100028494671419
– Name: Shafi Khan
– Friends: 4961
– Business: false
– Marketplace: true
– Country:
The U+2013 en-dash (-) line prefix combined with the
Friends: / Business: / Marketplace: Facebook-Graph-API
field trio is unique to this artifact: every other dash-
prefix family in this catalog uses the ASCII hyphen-minus
or em-dash glyph, and no malware-family parser carries
this Facebook-specific field set. False-positive risk is
low because the trio of keys is too specific to overlap
with any system-info format. Triage: any IOC tagged with
this family means the victim had a Facebook session
compromised by a Facebook-targeting infostealer, even when
no other system-info file is present in the victim folder.