RaccoonO365 Phishing Service Disrupted, Leader Identified

RaccoonO365 Phishing Service Disrupted, Leader Identified reports that Microsoft and Cloudflare teamed up to dismantle the RaccoonO365 operation, a phishing service used to steal thousands of users’ credentials. The service has been rented on a phishing-as-a-service model, with prices from $355 for a 30‑day plan to $999 for 90 days, and Microsoft estimates the operation earned at least $100,000 in cryptocurrency.

At least 5,000 credentials from users in 94 countries were reportedly stolen since July 2024, though attackers may not have been able to use all compromised credentials. According to Microsoft, the alleged leader is Joshua Ogundipe, a Nigerian programmer, with several associates aiding development, customer support and sales; international law enforcement has been notified.

In early September, Cloudflare banned RaccoonO365 domains, removed Workers scripts, and suspended associated user accounts, while Microsoft seized over 330 domains and filed a lawsuit with Health-ISAC to disrupt the infrastructure and disrupt targeting of healthcare organisations. According to Microsoft, at least 20 US healthcare organisations were affected, and the campaign often led to malware and ransomware.