Skip to main content
See every side of every news story
Published loading...Updated

Joint Microsoft and Cloudflare operation disrupts phishing as a service targeting Microsoft 365 credentials

  • Microsoft and Cloudflare disrupted the RaccoonO365 phishing-as-a-service operation by seizing 338 websites linked to the group in early September 2025.
  • The takedown followed an investigation that revealed Joshua Ogundipe, a Nigerian programmer, led a criminal enterprise selling subscription-based phishing kits on Telegram to over 850 members.
  • RaccoonO365 kits sent emails with malicious links, attachments, or QR codes that redirected victims to fake Microsoft 365 login pages to harvest credentials and bypass multifactor authentication.
  • Microsoft reported that the group obtained over 5,000 credentials across 94 countries and received cryptocurrency payments totaling $100,000 or more from approximately 100 subscriptions, while cautioning that gaps in international laws may enable scammers to quickly reestablish operations.
  • Microsoft called on governments to harmonize cybercrime legislation and enhance cooperation between technology companies and law enforcement agencies to prevent cybercriminals from rapidly reestablishing phishing schemes.
Insights by Ground AI

18 Articles

Think freely.Subscribe and get full access to Ground NewsSubscriptions start at $9.99/yearSubscribe

Bias Distribution

  • 100% of the sources are Center
100% Center

Factuality 

To view factuality data please Upgrade to Premium

Ownership

To view ownership data please Upgrade to Vantage

The Record by Recorded Future broke the news in on Tuesday, September 16, 2025.
Sources are mostly out of (0)
News
For You
Search
BlindspotLocal