Microsoft Dismantles RaccoonO365 Phishing Service

Microsoft’s Digital Crimes Unit (DCU) has dismantled the RaccoonO365 phishing service, seizing 338 websites linked to the operation and cutting off criminals’ access to victims, according to Microsoft. Since July 2024, RaccoonO365 kits have been used to steal at least 5,000 Microsoft credentials across 94 countries, with attacks extending to over 2,300 U.S. organizations and at least 20 healthcare organisations, the company notes.

RaccoonO365, also tracked as Storm-2246, provided subscription-based phishing kits that mimic official Microsoft communications and could let criminals send thousands of phishing emails a day, potentially totalling hundreds of millions annually. The operator identified by Microsoft is Joshua Ogundipe, based in Nigeria, who marketed the service via Telegram to more than 850 members and received at least $100,000 in cryptocurrency payments.

The operation included features such as up to 9,000 target emails per day and an AI-MailCheck module designed to scale operations and increase attack sophistication. Microsoft also emphasised the broader challenges posed by international law gaps and called for cross-border collaboration to close these loopholes.