Raccoon Stealer
A low-cost stealer whose alleged operator was arrested in 2022. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- Raccoon
- Seen since
- 2019
- Runs on
- Windows
- Sold as
- A cheap weekly or monthly subscription
What Raccoon Stealer takes
- Browser passwords, cookies, autofill entries and saved cards
- Cryptocurrency wallets
- Files, a screenshot and details of the computer
How it spreads
- Phishing emails
- Cracked software and fake installers
- Malicious ads
Background
Raccoon was popular because it was cheap and easy to run. Its operation paused in March 2022 and a second version appeared a few months later.
A Ukrainian man accused of running it was arrested in the Netherlands in 2022 and extradited to the United States, where the FBI said it had identified tens of millions of stolen credentials from the operation.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, Raccoon Stealer included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was Raccoon Stealer or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- RedLine Stealer: For years the most common source of stealer logs on the market.
- Lumma Stealer: The stealer behind the fake “verify you are human” pages.
- Vidar: A long-running stealer, often delivered together with other malware.
- StealC: A newer stealer that borrows from Vidar, Raccoon and RedLine.
- Atomic macOS Stealer: Proof that Macs get infostealers too.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.