Microsoft’s Digital Crimes Unit (DCU) mentioned it has disrupted RaccoonO365, a subscription-based phishing service blamed for stealing hundreds of Microsoft 365 credentials.
The corporate mentioned it recognized a Nigeria-based particular person, Joshua Ogundipe, because the chief of the operation.
Utilizing a U.S. court docket order from the Southern District of New York, the DCU seized 338 web sites linked to the service, reducing off the infrastructure criminals used to host faux Microsoft login pages and route stolen information.
In line with Microsoft, RaccoonO365 bought easy-to-use phishing kits on Telegram that permit even low-skilled criminals impersonate Microsoft communications and harvest usernames and passwords.
Since July 2024, the kits have been used to steal at the least 5,000 Microsoft credentials throughout 94 international locations, the corporate mentioned. As a result of subscriptions are reusable, a single subscription can ship hundreds of phishing emails each day, scaling to a whole lot of hundreds of thousands of malicious emails per 12 months.
Ogundipe’s function
Microsoft mentioned its investigation recognized Ogundipe and associates as taking part in specialised roles within the enterprise: growing the code, promoting subscriptions, and offering customer assist to different cybercriminals.
“To masks their felony enterprise and evade detection, they registered Web domains utilizing fictitious names and bodily addresses which are purportedly positioned in a number of cities and international locations.
“Based mostly on Microsoft’s evaluation, Ogundipe has a background in pc programming and is believed to have authored the vast majority of the code,” Microsoft said.
It additional disclosed that an operational safety lapse by the risk actors, wherein they inadvertently revealed a secret cryptocurrency pockets, helped the DCU’s attribution and understanding of their operations.
“A felony referral for Ogundipe has been despatched to worldwide legislation enforcement,” Microsoft added.
Healthcare and public-safety dangers
Microsoft highlighted that RaccoonO365 was not simply stealing credentials for fraud; its phishing kits had been utilized in campaigns that focused crucial sectors.
- The DCU discovered a tax-themed marketing campaign that hit greater than 2,300 organisations (principally within the U.S.), and mentioned the kits have been used in opposition to at the least 20 U.S. healthcare organisations.
- Microsoft and associate Well being-ISAC say such campaigns can precede malware and ransomware intrusions that disrupt affected person care, delay companies, and expose delicate well being information.
In line with Microsoft, these extreme penalties are a key purpose why the DCU is submitting this lawsuit in partnership with Well being-ISAC—a worldwide non-profit targeted on cybersecurity and risk intelligence for the well being sector.
Extra insights
Microsoft revealed that in simply over a 12 months, RaccoonO365 has swiftly advanced, rolling out common upgrades to satisfy rising demand.
- This speedy development underscores why taking authorized motion now could be essential to stopping RaccoonO365’s actions.
- Utilizing RaccoonO365’s companies, clients can enter as much as 9,000 goal e-mail addresses per day and make use of subtle strategies to bypass multi-factor authentication protections to steal consumer credentials and acquire persistent entry to victims’ programs.
- Most not too long ago, the group began promoting a brand new AI-powered service, RaccoonO365 AI-MailCheck, designed to scale operations and improve the sophistication—and effectiveness—of assaults.
In the meantime, a latest report by Verify Level Analysis, had revealed that Microsoft was probably the most impersonated model, showing in 25% of all phishing makes an attempt globally between April and June 2025, a document aggravated by networks like Raccoon0365.
Be First to Comment