Microsoft has announced the seizure of nearly 340 websites linked to a Nigerian-based phishing subscription service known as Raccoon0365, which is accused of stealing thousands of user credentials.
The action followed a US district court order in Manhattan, granting Microsoft authority to take control of domains associated with the network.
The company said the operation was part of a broader crackdown on cybercrime.
Raccoon0365 allegedly provided paying subscribers with tools to impersonate trusted brands and lure victims into entering login details on fake Microsoft webpages.
Related News: Oyetola congratulates Aliyah, winner of Microsoft Office Specialist competition
Nigerian Govt Shuts Over Thirteen Million Social Media Accounts
China Unveils Plans For Pregnancy-Capable Humanoid Robot
The service operated via a private Telegram channel with more than 850 subscribers.
According to Steven Masada, assistant general counsel for Microsoft’s Digital Crimes Unit, the network generated at least $100,000 in cryptocurrency for its operators since its launch in July 2024.
Microsoft identified a Nigeria-based individual, Joshua Ogundipe, as the leader of the operation.
Requests for comment sent to him by international media outlets received no response.
Investigators said the phishing campaigns targeted multiple industries, with a strong focus on organisations in New York City.
Between 12 and 28 February 2025 alone, the network allegedly targeted more than 2,300 organisations through tax-themed phishing emails.
The US health sector was also affected. Errol Weiss, chief security officer of the Health Information Sharing & Analysis Center, confirmed that five healthcare organisations were compromised, while 25 others were targeted unsuccessfully.
Weiss warned: “Once hackers gain access to healthcare networks, the consequences can be severe and highly unpredictable. The potential risks to sensitive data and operations are enormous.”
Raccoon0365’s operators attempted to hide their infrastructure using Cloudflare’s services. However, Cloudflare worked alongside Microsoft and the US Secret Service to disrupt their systems and block new accounts.
Blake Darché, head of threat intelligence at Cloudflare, explained: “The operators made several operational security mistakes, but their methods were still highly effective in deceiving victims.”
Masada stressed the broader danger of such services, stating: “Simple tools such as Raccoon0365 make cybercrime accessible to virtually anyone, putting millions of users at risk.”
Microsoft said it will continue collaborating with global law enforcement and technology partners to identify, disrupt, and dismantle cybercrime networks operating across borders.
