Microsoft has shut down nearly 340 websites tied to a Nigerian-based phishing syndicate known as Raccoon0365. The network allegedly stole at least 5,000 Microsoft account credentials from unsuspecting users.
The action came after Microsoft secured a US district court order in Manhattan, granting it authority to seize the domains linked to the operation. Raccoon0365 ran as a subscription service on a private Telegram channel with more than 850 paying members.
Through the platform, criminals posed as trusted brands and tricked victims into entering their login details on fake Microsoft pages. The stolen information was then resold or used for deeper attacks.
Leader Identified in Nigeria
Steven Masada, assistant general counsel for Microsoft’s digital crimes unit, said the syndicate had earned at least $100,000 in cryptocurrency since July 2024. Microsoft identified Nigerian national Joshua Ogundipe as the ringleader. He declined to respond to inquiries.
The group’s phishing campaigns hit multiple industries. A major portion of the attacks targeted organisations in New York City. Between February 12 and 28, 2025, the service allegedly sent tax-related phishing emails to more than 2,300 US-based organisations.
Healthcare was also affected. According to Errol Weiss, chief security officer at the Health Information Sharing & Analysis Center, five unnamed healthcare firms lost credentials while 25 others faced attacks. “Once hackers gain access to networks, the consequences can be severe and highly unpredictable,” Weiss warned.
Cloudflare and US Secret Service Step In
Raccoon0365 relied heavily on Cloudflare’s services to mask its infrastructure. But Cloudflare cooperated with Microsoft and the US Secret Service to dismantle the operation and block new accounts.
Blake Darché, head of threat intelligence at Cloudflare, admitted the group made errors in its operational security. Still, their campaigns remained highly effective.
Masada cautioned about the wider risks: “Simple tools such as Raccoon0365 make cybercrime accessible to virtually anyone, putting millions of users at risk.”
This situation shows how phishing kits continue to thrive on the dark web, making cybercrime easy for even unskilled users.
Rate, Like 👍, Comment💬, share this article and Follow us on our social media handles. You can also Submit your own story to get featured and earn rewards!
WhatsApp Channel
Telegram Channel
