Loading story…
Raccoon Stealer, a malware-as-a-service infostealer sold on underground forums since 2019, was widely distributed through pirated software, fake cracks, game cheats, phishing, and large YouTube-based lure campaigns. Researchers tied deliveries to fake Microsoft Office and Adobe Photoshop cracks, hijacked YouTube accounts and video descriptions, and broader ecosystems using loaders such as Buer, SmokeLoader, and AveMaria RAT. Once executed, the malware stole browser passwords, cookies, autofill data, credit card details, cryptocurrency wallet files, screenshots, Telegram data, and other arbitrary files, while some campaigns also dropped secondary payloads including credential theft tools and a crypto miner.
Pull IOCs and campaign context straight into your stack.
26 events from the most recent confirmed update back to the earliest known activity.
CloudSEK analyzed a recent Raccoon Stealer v2 sample and disclosed that its packer used anti-analysis and anti-debugging techniques, including hooks on ntdll!DbgUiRemoteBreakin and ntdll!ZwProtectVirtualMemory. The report also detailed updated string encoding, victim profiling, C2-controlled theft modules, and optional payload delivery.
ZeroFox Intelligence discovered on June 4, 2022 that an information stealer distributed through the ProCrackerz fake crack site was actually Raccoon Stealer 2.0, also called Recordbreaker.
Zscaler reported that the analyzed Raccoon Stealer v2 sample retained debug information showing a compilation timestamp of 2022-05-26 13:58:25 UTC.
ZeroFox said that in May 2022, logs matching Recordbreaker activity were offered for sale with 'Raccoon Stealer V2.0' branding, supporting the link between the malware families.
ZeroFox reported that the earliest known sample of the stealer later identified as Raccoon Stealer 2.0 was uploaded to VirusTotal on April 19, 2022.
The original Raccoon Stealer malware-as-a-service operation shut down in March 2022, with its operators attributing the closure to the reported death of a lead developer during Russia's invasion of Ukraine. The remaining team said they planned to return with a second version of the malware.
Avast said that by February 17, 2022, its systems had observed more than 25,000 Raccoon-related samples, over 1,300 distinct configurations, and nearly 600,000 blocked attack attempts during the tracking period.
Avast's report measured Raccoon activity from March 3, 2021, starting the period in which it later counted more than 25,000 samples and nearly 600,000 attack attempts.
Sophos described a Raccoon Stealer campaign that used search-engine-optimized fake cracked-software sites and YouTube promotion to infect victims. The delivery chain also dropped secondary payloads including a SilentXMRMiner-based cryptocurrency miner and the QuilClipper clipboard hijacker, with VirusTotal seeing related xsph.ru payloads between October 2020 and April 2021.
Group-IB reported that the campaign's third wave began on June 29, 2020, with microsoft-cloud*.co.za domains used to deliver Raccoon Stealer samples.
Cyble reported that the Raccoon Stealer sample it analyzed carried a compilation timestamp of 2020-06-24 05:58:17.
Group-IB noted that the first Raccoon samples using a Telegram channel named blintick to retrieve encrypted replacement C2 addresses appeared on VirusTotal in late May 2020.
Group-IB said the FakeSecurity-linked malware distribution campaign began on February 19, 2020 and initially delivered Vidar stealer via malicious macro documents and phishing infrastructure.
In the campaign's second wave during 2020, attackers moved from distributing Vidar to distributing Raccoon Stealer through macro lure documents and related domains.
Group-IB said it discovered in summer 2020 a malware distribution campaign that abused Telegram channels to support delivery of Vidar and later Raccoon Stealer.
Researchers reported that the oldest observed Raccoon Stealer samples had timestamps from the end of April 2019, showing the malware was active in the wild by then.
Raccoon Stealer's authors stated that they began selling the malware on underground forums in April 2019, marking the start of its malware-as-a-service availability.
AhnLab ASEC confirmed a RecordBreaker campaign distributed through a likely hijacked YouTube account with more than 120,000 subscribers, using crack-themed links to deliver the malware.
Zscaler reported that a new variant, Raccoon Stealer v2, was released in early July 2022 as a major update to the malware family.
Zscaler said Raccoon Stealer v2 was first seen on July 3, 2022, marking the emergence of the new generation of the malware family.
Google said it was aware of the YouTube-based malware campaign and was taking action to block the threat actor's activity while flagging associated links to Safe Browsing.
Cluster25 reported a large-scale campaign using thousands of YouTube videos and channels to distribute password-stealing malware, including Raccoon Stealer, through links in video descriptions.
CyberArk Labs released a white paper detailing Raccoon Stealer's execution flow, including its CIS-language avoidance checks, Google Drive-based C2 retrieval, browser/email/wallet theft routines, exfiltration process, and self-deletion behavior. The report also published indicators of compromise and a YARA rule for detection.
Before publication of the report on the leak, the exposed Elasticsearch server disappeared, though it was unclear whether the provider or the operators removed it.
Bob Diachenko said he spent weeks trying to get the cloud provider to take down the exposed Elasticsearch server used to store stolen Raccoon data.
An exposed, unprotected Elasticsearch server leaked victim data believed to have been collected from hosts infected with RaccoonStealer version 1.7.2, including passwords and authentication cookies.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 289 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
19 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcegroup-ib.com
Open sourcecybereason.com
Open sourceasec.ahnlab.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcelp.cyberark.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian national **Mark Sokolovsky** was sentenced to five years in prison for his role in operating **Raccoon Stealer**, a malware-as-a-service infostealer that prosecutors said was rented to other criminals for **$75 per week** or **$200 per month** in cryptocurrency. U.S. authorities said the platform infected millions of computers and stole more than **52 million credentials** along with cryptocurrency wallets, payment card data, email records, and other sensitive information later used in fraud, identity theft, and ransomware attacks. Sokolovsky was arrested in the Netherlands in March 2022, extradited to the United States in February 2024, and later pleaded guilty after being charged with fraud, money laundering, and aggravated identity theft. The case followed a coordinated FBI and European law enforcement operation that dismantled Raccoon Stealer infrastructure in the Netherlands and Italy and led to the launch of the FBI victim-notification portal at `raccoon.ic3.gov`. Independent research by Team Cymru linked Raccoon’s management activity to **Kharkiv, Ukraine**, identified a Tor-based customer panel and Telegram update server, and tied the operation to the **CC2BTC** stolen-card marketplace, suggesting the operators monetized victim data both by leasing the malware and by reselling stolen payment cards. Despite the takedown, the malware family later resurfaced as **Recordbreaker**, also described as **Raccoon Stealer v2**, with a rewritten codebase and updated delivery and exfiltration features.
Aug 15, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026