{
	"id": "cbb65ba6-dc5e-4cbb-87c1-4070050a3643",
	"created_at": "2026-04-06T00:15:17.161568Z",
	"updated_at": "2026-04-10T13:12:55.534305Z",
	"deleted_at": null,
	"sha1_hash": "248a6e8eade055e5f0f66a227d45b541e66df610",
	"title": "Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 279181,
	"plain_text": "Raccoon and Vidar Stealers Spreading via Massive Network of\r\nFake Cracked Software\r\nBy The Hacker News\r\nPublished: 2023-01-16 · Archived: 2026-04-05 21:31:55 UTC\r\nA \"large and resilient infrastructure\" comprising over 250 domains is being used to distribute information-stealing\r\nmalware such as Raccoon and Vidar since early 2020.\r\nThe infection chain \"uses about a hundred of fake cracked software catalogue websites that redirect to several\r\nlinks before downloading the payload hosted on file share platforms, such as GitHub,\" cybersecurity firm\r\nSEKOIA said in an analysis published earlier this month.\r\nThe French cybersecurity company assessed the domains to be operated by a threat actor running a traffic\r\ndirection system (TDS), which allows other cybercriminals to rent the service to distribute their malware.\r\nThe attacks target users searching for cracked versions of software and games on search engines like Google,\r\nsurfacing fraudulent websites on top by leveraging a technique called search engine optimization (SEO) poisoning\r\nto lure victims into downloading and executing the malicious payloads.\r\nhttps://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html\r\nPage 1 of 3\n\nThe poisoned result comes with a download link to the promised software that, upon clicking, triggers a five-stage\r\nURL redirection sequence to take the user to a web page displaying a shortened link, which points to a password-protected RAR archive file hosted on GitHub, along with its password.\r\n\"Using several redirections complicates automated analysis by security solutions,\" the researchers said. \"Carving\r\nthe infrastructure as such is almost certainly designed to ensure resilience, making it easier and quicker to update\r\nor change a step.\"\r\nShould the victim uncompress the RAR archive and run the purported setup executable contained within it, either\r\nof the two malware families, Raccoon or Vidar, are installed on the system.\r\nThe development comes as Cyble detailed a rogue Google Ads campaign that employs widely-used software such\r\nas AnyDesk, Bluestacks, Notepad++, and Zoom as lures to deliver a feature-rich stealer known as Rhadamanthys\r\nStealer.\r\nAn alternate variant of the attack chain has been observed taking advantage of phishing emails masquerading as\r\nbank statements to dupe unwitting users into clicking on booby-trapped links.\r\nFabricated websites impersonating the popular remote desktop solution have also been put to use in the past to\r\npropagate a Python-based information stealer dubbed Mitsu Stealer.\r\nBoth pieces of malware are equipped to siphon a wide range of personal information from compromised\r\nmachines, harvest credentials from web browsers, and steal data from various cryptocurrency wallets.\r\nhttps://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html\r\nPage 2 of 3\n\nUsers are advised to refrain from downloading pirated software and enforce multi-factor authentication wherever\r\npossible to harden accounts.\r\n\"It is crucial for users to exercise caution when receiving spam emails or to visit phishing websites and to verify\r\nthe source before downloading any applications,\" the researchers said.\r\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\r\nwe post.\r\nSource: https://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html\r\nhttps://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://thehackernews.com/2023/01/raccoon-and-vidar-stealers-spreading.html"
	],
	"report_names": [
		"raccoon-and-vidar-stealers-spreading.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434517,
	"ts_updated_at": 1775826775,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/248a6e8eade055e5f0f66a227d45b541e66df610.pdf",
		"text": "https://archive.orkl.eu/248a6e8eade055e5f0f66a227d45b541e66df610.txt",
		"img": "https://archive.orkl.eu/248a6e8eade055e5f0f66a227d45b541e66df610.jpg"
	}
}