Dashboard

Raccoon Stealer

A cheap Windows stealer. Its alleged operator was arrested in 2022.

Also called
Raccoon
Seen since
2019
Runs on
Windows
Sold as
A cheap weekly or monthly subscription

What Raccoon Stealer takes

  • Browser passwords, cookies, autofill, and saved cards
  • Cryptocurrency wallets
  • Files, a screenshot, and details of the computer

How it spreads

  • Phishing mail
  • Cracked software and fake installers
  • Malicious ads

Background

Raccoon was cheap and easy to rent, so many low-skill buyers ran it. The service paused in March 2022. A second version appeared a few months later.

A Ukrainian man accused of running it was arrested in the Netherlands in 2022 and extradited to the United States. The FBI said the operation had produced tens of millions of stolen credentials. Those files are still traded.

Checking for your logins

Search an email, username, company domain, login URL, password, or IP. The index covers logs from every family, Raccoon Stealer included. A dump usually does not record which malware wrote it, so a result will not say it was Raccoon Stealer.

The steps afterwards are the same either way. Clean the device, then change passwords from a machine that was not infected. What to do.

Other families

  • RedLine Stealer. For years the most common Windows stealer in circulating logs.
  • Lumma Stealer. Often delivered by fake verify-you-are-human pages.
  • Vidar. A long-running Windows stealer, often dropped with other malware.
  • StealC. A 2023 Windows stealer that copies features from older families.
  • Atomic macOS Stealer. A macOS stealer. It prompts for the user password and opens the Keychain.

Questions

Did the 2022 arrest stop Raccoon logs?
It stopped that operator. A later version appeared the same year. Older dumps stay on Telegram.
Why do Raccoon logs still matter?
A password that was never changed still works. Cookies from those logs may be dead, but the passwords are not.

Search an email, username, URL, password, or IP. Open search.

More