Raccoon Stealer Abuses Telegram Infrastructure to Store C&C Addresses

By 2020, Racoon Stealer has become one of the most affordable data theft software.

Last Updated: 2026-04-10

Raccoon Stealer Abuses Telegram Infrastructure to Store C&C Addresses

In 2025 and 2026, Raccoon Stealer remains a prevalent threat, leveraging social engineering and sophisticated distribution methods to infiltrate users' systems. Despite initially surfacing in 2019, Raccoon Stealer has continued to evolve, enabling hackers to steal a wide range of sensitive data. It is also easily accessible to cybercriminals through a malware as a service (MaaS) model, increasing the risk it poses to users and organizations alike.

This analysis examines the evolution of Raccoon Stealer, how it operates, its use of Telegram infrastructure to store command and control (C2) addresses, and the distribution strategies that have kept it relevant in the malware landscape through 2026.

The Origin and Development of Raccoon Stealer

Raccoon Stealer first appeared on underground hacking forums in 2019 as a data theft malware as a service (MaaS) tool. Quickly adopted due to its relatively low cost and ease of use, Raccoon Stealer's creators have consistently updated the malware, enhancing its capabilities to adapt to new security measures.

Its subscription model enabled widespread use, providing aspiring hackers with ready to use malicious software and support. This broad accessibility led to a rise in phishing attacks, downloads containing malware, and social engineering tactics aimed at distributing Raccoon Stealer globally.

How Raccoon Stealer Abuses Telegram for Command and Control

One of the most technically notable aspects of Raccoon Stealer is its use of Telegram's public infrastructure to store and retrieve its command and control (C2) server addresses. Rather than hardcoding a C2 IP address into the malware, which would make it trivial for defenders to block after discovery, Raccoon Stealer operators publish the current C2 address in an encrypted format within a Telegram channel or bot.

When an infected device runs the malware, it queries the Telegram resource to retrieve the active C2 address, then connects to that server to transmit stolen data and receive instructions. This approach gives operators several advantages: Telegram's infrastructure is widely trusted and difficult to block, the C2 address can be updated quickly if defenders identify and blacklist it, and the communication blends in with legitimate Telegram traffic. This technique has been widely adopted by other infostealer families in 2025 and 2026.

What Does Raccoon Stealer Steal?

One of the primary reasons Raccoon Stealer is so attractive to cybercriminals is its ability to harvest an array of sensitive data. Here is what Raccoon Stealer targets:

Raccoon Stealer captures usernames and passwords saved in browsers, targeting those stored in cookies and autofill forms. This stolen data is often used for credential stuffing attacks, enabling unauthorized access to accounts. Read more about credential stuffing and how it works.

2. Crypto Wallet Data

Given the rise of cryptocurrency, Raccoon Stealer was designed to locate and extract crypto wallet files. This has made it a popular choice among attackers looking to steal valuable assets stored in digital wallets. In 2025 and 2026, cryptocurrency theft via infostealers has become a primary revenue source for organized cybercriminal groups.

3. Email Client Logins

By extracting credentials from email clients, Raccoon Stealer can provide cybercriminals access to sensitive communications, increasing the risk of further phishing attacks or impersonation.

4. Browser Plugin Data and Extensions

Raccoon Stealer does not just focus on browser data. It also targets data stored in browser plugins and extensions. This includes autofill data, allowing it to gather even more information about users' habits and accounts.

5. Command and Control (C2) Capabilities

Raccoon Stealer is configured to communicate with command and control (C2) servers, retrieving the active server address dynamically from Telegram. This connection enables remote attackers to execute commands, modify files, and perform actions directly on infected devices without hardcoding any server addresses.

This combination of data theft capabilities makes Raccoon Stealer a comprehensive tool for identity theft and unauthorized access to accounts and assets.

How Raccoon Stealer is Distributed

Raccoon Stealer has a variety of distribution methods, all designed to maximize reach and ensure its installation on as many devices as possible. Key distribution channels include:

1. Buer Loader and GCleaner

Cybercriminals have used loaders like Buer Loader and GCleaner to distribute Raccoon Stealer. Loaders are malware types that facilitate the delivery of other malicious software. These loaders often exploit vulnerabilities in target systems to bypass security protocols.

2. Fake Software and Gaming Cheats

Raccoon Stealer is frequently bundled with fake patches, cracks, and cheats for popular video games like Fortnite, Valorant, and NBA2K22. This tactic takes advantage of users looking to circumvent software restrictions or gain an edge in gaming, making them easy targets for malware disguised as legitimate downloads.

3. Malware Packers and Obfuscators

Malware packers like Themida help distribute Raccoon Stealer by compressing or encrypting the malware's code. This process obfuscates the malware's presence, making it harder for antivirus programs to detect. Cybercriminals use packers to prolong the lifespan of the malware and improve its effectiveness in avoiding security defenses.

Another common distribution tactic involves embedding Raccoon Stealer within fake or fraudulent applications. Social engineering plays a key role here, as attackers trick users into downloading these fake applications, believing them to be genuine tools or utilities.

The Impact of Raccoon Stealer on Security in 2026

Raccoon Stealer's wide availability and powerful capabilities make it a top concern for security teams. Employee security awareness training is essential to prevent social engineering attacks, and tools like phishing simulators are invaluable in preparing staff to recognize and avoid these types of threats.

Implementing layered security protocols, such as multifactor authentication (MFA), continuous monitoring, and endpoint protection can also limit the damage if Raccoon Stealer infiltrates a system. Organizations should also ensure that phishing emails carrying Raccoon Stealer payloads are identified and blocked before they reach employees, using Keepnet's Email Threat Simulator to verify that email gateways actually block these threats.

By staying informed about evolving malware trends like Raccoon Stealer, organizations can take proactive steps to minimize the likelihood of successful attacks and better protect their data.

Key Takeaways

Raccoon Stealer is a MaaS malware first released in 2019 and continues to be used actively in 2025 and 2026.

The malware targets login credentials, crypto wallets, email client data, and browser extensions, among other information.

Raccoon Stealer abuses Telegram infrastructure to store and dynamically retrieve C2 server addresses, making it resilient against takedowns.

Raccoon Stealer's distribution methods include loaders, fake gaming cheats, and malware packers to avoid detection.

Preventing attacks requires comprehensive employee training, robust security measures, and layered defense strategies.

Editor's Note: This article was updated on April 10, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Automate behaviour-based security awareness training for employees to identify and report threats: phishing, vishing, smishing, quishing, MFA phishing, callback phishing!

Automate phishing analysis by 187x and remove threats from inboxes 48x faster.

Use our AI-driven human-centric platform with Autopilot and Self-driving features to efficiently manage human cyber risks.

Frequently Asked Questions

What is Raccoon Stealer?

Raccoon Stealer is a data theft malware that operates on a malware as a service (MaaS) model, meaning cybercriminals can subscribe to use it without needing to develop their own tools. First identified in 2019, it targets login credentials, crypto wallet files, email client data, browser cookies, and extension data. It communicates with attacker infrastructure through command and control (C2) servers, and in its more recent versions, retrieves C2 addresses dynamically from Telegram channels to evade detection and takedowns.

How does Raccoon Stealer use Telegram for command and control?

Instead of hardcoding a C2 server address into the malware binary, Raccoon Stealer operators publish the current C2 IP address in encrypted form within a Telegram channel or bot. When an infected device runs the malware, it queries Telegram to retrieve the active C2 address and then connects to it to exfiltrate stolen data. This technique makes Raccoon Stealer more resilient because operators can update the C2 address at any time without redeploying the malware, and Telegram traffic is difficult to block without disrupting legitimate communications.

What data does Raccoon Stealer steal?

Raccoon Stealer collects saved browser passwords, autofill data, and session cookies from all major browsers. It also targets cryptocurrency wallet files, email client credentials, and data stored in browser extensions. This comprehensive data collection makes a single Raccoon Stealer infection potentially very damaging, as victims may lose access to multiple accounts and financial assets simultaneously.

How is Raccoon Stealer distributed?

Raccoon Stealer reaches victims through several distribution channels. It is commonly bundled with fake software cracks, game cheats, and pirated applications. It is also delivered via phishing emails containing malicious attachments or links. Malware loaders like Buer Loader and GCleaner are used to drop Raccoon Stealer onto already compromised systems. Malware packers and obfuscators help the malware evade antivirus detection during installation.

Is Raccoon Stealer still active in 2026?

Yes. Despite law enforcement action that temporarily disrupted Raccoon Stealer's infrastructure in 2022, the malware returned with updated versions in 2023 and has remained active through 2025 and 2026. Its operators have continued to add new evasion techniques, update distribution methods, and maintain the C2 infrastructure hosted on Telegram infrastructure. Security researchers continue to track Raccoon Stealer as one of the most widely deployed infostealer families globally.

What is a malware as a service (MaaS) model?

Malware as a service (MaaS) is a criminal business model in which malware developers sell or lease access to their malicious software to other cybercriminals. Subscribers receive the malware itself along with a online control panel, customer support, and regular updates. This model lowers the technical barrier to launching attacks, allowing individuals with little programming knowledge to conduct sophisticated campaigns. Raccoon Stealer's MaaS model was a key reason for its rapid global adoption after 2019.

How can organizations detect a Raccoon Stealer infection?

Detection indicators include unexpected outbound connections to Telegram or unknown IP addresses, sudden appearance of processes consuming unusual system resources, anomalous browser behavior or credential alerts from affected users, and alerts from endpoint detection and response (EDR) tools flagging known Raccoon Stealer signatures. Organizations should also monitor for credential compromise across corporate accounts, as stolen credentials are often tested within hours of exfiltration. Keepnet's Phishing Incident Responder helps security teams triage reports of suspicious phishing emails that may be delivering Raccoon Stealer payloads.

How does phishing deliver Raccoon Stealer to victims?

Phishing is one of the primary delivery mechanisms for Raccoon Stealer. Attackers send emails impersonating software vendors, game publishers, or legitimate services, directing recipients to download a file that appears legitimate but contains the malware. Once the user opens the file, Raccoon Stealer installs silently in the background and begins collecting data. This is why security awareness training and phishing simulations are critical defenses against infostealer malware.

What should an organization do if Raccoon Stealer is detected on an endpoint?

Immediately isolate the affected device from the network to prevent further data exfiltration. Force a password reset on all accounts accessible from that device, including email, cloud services, and any web applications the user accessed. Revoke all active sessions and browser cookies associated with those accounts. Conduct forensic analysis to determine how long the infection was active and what data was collected. Notify affected users and, if regulated data was compromised, follow applicable breach notification requirements.

How does Keepnet help protect organizations against Raccoon Stealer in 2026?

Keepnet addresses the human and email layers through which Raccoon Stealer most commonly reaches organizations. Its phishing simulator trains employees to recognize the fake download and software crack lures used to deliver the malware. The Email Threat Simulator verifies that email gateways block malicious attachments before they reach users. Adaptive security awareness training reinforces safe download behavior and credential hygiene. And the Phishing Incident Responder ensures that when employees do report suspicious emails, security teams can triage and contain the threat rapidly.