US EditionJoint Microsoft and Cloudflare operation disrupts phishing as a service targeting Microsoft 365 credentials
- Microsoft and Cloudflare disrupted the RaccoonO365 phishing-as-a-service operation by seizing 338 websites linked to the group in early September 2025.
- The takedown followed an investigation that revealed Joshua Ogundipe, a Nigerian programmer, led a criminal enterprise selling subscription-based phishing kits on Telegram to over 850 members.
- RaccoonO365 kits sent emails with malicious links, attachments, or QR codes that redirected victims to fake Microsoft 365 login pages to harvest credentials and bypass multifactor authentication.
- Microsoft reported that the group obtained over 5,000 credentials across 94 countries and received cryptocurrency payments totaling $100,000 or more from approximately 100 subscriptions, while cautioning that gaps in international laws may enable scammers to quickly reestablish operations.
- Microsoft called on governments to harmonize cybercrime legislation and enhance cooperation between technology companies and law enforcement agencies to prevent cybercriminals from rapidly reestablishing phishing schemes.
24 Articles
24 Articles
Microsoft seizes hundreds of phishing sites tied to massive credential theft operation
Microsoft’s Digital Crimes Unit coordinated the seizure of 338 domains used by RaccoonO365, a financially motivated threat group that developed and sold phishing kits that have been used to steal more than 5,000 Microsoft credentials since July 2024, the company said Tuesday. The threat group, which Microsoft tracks as Storm-2246, enabled cybercriminals to steal credentials from organizations spanning 94 countries, making it the “fastest-growin…
RaccoonO365, a powerful phishing platform, has been implicated in the theft of credentials from thousands of Microsoft accounts. This subscription-based service, used by hundreds of aspiring cybercriminals, puts many Internet users at risk. With the help of Cloudflare, Microsoft has fought back.
Microsoft's Digital Crimes Unit (DCU) has seized 338 websites connected to "RaccoonO365" by a court order of the Southern District of New York. The aim was to disrupt the service's technical infrastructure and to deprive criminals of access to victim accounts. RaccoonO365 is a phishing toolkit that steals Microsoft's 365 access data. This case shows that cybercriminals [...] Microsoft's contribution confiscated 338 sites to destroy the fast-grow…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
