Raccoon Stealer
Also known as: Raccoon, Raccoon infostealer
Raccoon Stealer is a malware-as-a-service infostealer that harvests passwords, cookies, autofill data, and cryptocurrency wallets from infected systems. It gained notoriety for its low price and ease of use, making credential theft accessible to non-technical criminals.
What is Raccoon Stealer?
Raccoon Stealer is an infostealer first sold around 2019 on a subscription basis. Its appeal was simplicity: an easy-to-use control panel and a low monthly fee made it popular with criminals who lacked technical skills. It collects the standard infostealer dataset — credentials, cookies, autofill, cards, and crypto wallets — and supports downloading additional malware.
History and disruption
Raccoon's operations were disrupted by law-enforcement action, and the project went through pauses and relaunches (a "Raccoon v2" followed earlier versions). Its history illustrates a recurring pattern in the stealer economy: even after takedowns, demand and rebranded successors keep families circulating.
Why Raccoon matters
Because Raccoon lowered the barrier to entry for credential theft, it contributed a large volume of stealer logs into criminal marketplaces. Credentials harvested by Raccoon have been linked to downstream account takeover and intrusion activity.
VantaPrism retains and indexes historical Raccoon stealer logs alongside current families, so analysts can search for legacy exposures that may still be valid and trace how long a credential has been circulating.
Check Your Exposure arrow_forwardFrequently Asked Questions
Is Raccoon Stealer still operational?
What made Raccoon Stealer popular?
Related Terms
Infostealer malware is a category of malicious software designed to silently harvest sensitive data — passwords, sess…
A stealer log is the package of data exfiltrated from a single device by infostealer malware. It typically contains s…
RedLine Stealer is an information-stealing malware (infostealer) sold as malware-as-a-service that harvests saved bro…
Malware-as-a-service (MaaS) is a criminal business model in which malware authors rent or sell their software, infras…
Account takeover (ATO) is when an attacker gains unauthorized control of a legitimate user account, typically using s…