Anyone With Saved Browser Passwords Targeted in the 202304_raccoon_666_bonus Log Exposing 12,620 Records

In April 2023, a Telegram user uploaded a stealer log file named 202304_raccoon_666_bonus, exposing 12,620 records harvested by Raccoon Stealer malware. The dataset contained plaintext passwords, email addresses, and URLs, all lifted directly from infected devices without the victims ever knowing. Raccoon Stealer does not discriminate between targets. If you have saved passwords in your browser, you are exactly who this malware was designed to compromize. Every record in this file belonged to an ordinary person who trusted their browser to store credentials safely.

Why This Is Dangerous

Raccoon Stealer is engineered specifically to pull saved login credentials out of browsers before victims notice anything is wrong. The passwords in this dump arrived already in plaintext, meaning attackers did not need to crack or decrypt anything. They could immediately begin testing those credentials against email accounts, banking portals, social media profiles, and workplace tools. The URLs included in the file acted as a targeting map, showing attackers exactly which services each victim was logged into at the time of infection. This combination makes the data among the most actionable available to cybercriminals.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• Endpoint URLs (active login pages and session data)

Why This Matters

Raccoon Stealer targets everyday internet users, not just corporations or high-value individuals. Anyone who saves passwords in Chrome, Firefox, or Edge is a potential victim. Once an attacker has a working email and password pair, credential stuffing tools can test those credentials across hundreds of platforms in minutes. Victims who reused passwords on banking apps, email providers, or employer portals face compounding risks. One stolen password can cascade into identity theft, unauthorised wire transfers, or corporate network intrusions. Most victims never recieve a notification because no single company was breached, the data came directly off their own infected machines.

How Stealer Logs Work

Raccoon Stealer is a malware-as-a-service infostealer that criminals can rent and deploy without advanced technical skills. It spreads through phishing campaigns, malicious email attachments, drive-by downloads from compromised websites, and pirated software bundles. Once installed, Raccoon silently extracts saved credentials from all major browsers including Chrome, Firefox, Edge, and Opera. It also collects autofill data, session cookies, cryptocurrency wallet files, and system information. The harvested data is packaged into a log file and uploaded to a remote server or shared directly on Telegram, as occurred with this dataset. The entire process from infection to credential theft can complete in under 60 seconds on an unprotected device.

Check If You Are Affected

HEROIC's free breach scanner searches across more than 400 billion compromised records, including Raccoon Stealer dumps like this one. If your email address or password appeared in the 202304_raccoon_666_bonus log or any other known breach, our scanner will identify it immediately so you can act before attackers do. Run a free scan at HEROIC.com, no account needed.