Nigeria Arrests RaccoonO365 Phishing Developer Linked to Microsoft 365 Attacks

Authorities in Nigeria have announced the arrest of three high-profile internet fraud suspects linked to phishing attacks, including the main developer behind the RaccoonO365 phishing-as-a-service toolkit. The Nigeria Police Force National Cybercrime Centre (NPF–NCCC) said investigations conducted in collaboration with Microsoft and the FBI led to identifying Okitipi Samuel, also known as Moses Felix, as the principal suspect and developer of the phishing infrastructure.

Investigations reveal that he operated a Telegram channel through which phishing links were sold for cryptocurrency and hosted fraudulent login portals on Cloudflare using stolen credentials, according to the NPF. RaccoonO365 is the name given to the group behind a PhaaS toolkit enabling credential harvesting by mimicking Microsoft 365 login pages, with Microsoft tracking the threat actor as Storm-2246.

The joint probe uncovered multiple incidents of unauthorised Microsoft 365 account access between January and September 2025 that originated from phishing messages designed to resemble legitimate Microsoft authentication pages, leading to business email compromise and data breaches across several sectors, the NPF said.