RaccoonO365 Phishing Network Shut Down After Microsoft and Cloudflare Disrupt 338 Domains

RaccoonO365, a phishing-as-a-service toolkit, was dismantled after Microsoft’s Digital Crimes Unit teamed up with Cloudflare to seize 338 domains tied to the operation. Microsoft said the takedown disrupted the group’s infrastructure, cutting off criminals’ access to victims, with Steven Masada, assistant general counsel at DCU, stating that the case shows cybercriminals don’t need to be highly sophisticated to cause widespread harm.

Since July 2024, the group is reported to have stolen more than 5,000 Microsoft 365 credentials from victims in 94 countries, using lookalike pages that mimicked trusted brands to harvest user data. The operation began with actions on September 2, 2025, continued on September 3 and 4, and was completed by September 8, according to the article, including domain bans, phish-warning interstitials, and Worker script terminations.

Subscribers could pay for access to RaccoonO365, with 30-day plans at $355 and 90-day plans at $999, while the mastermind, said to be Joshua Ogundipe, remains at large alongside four associates. Cloudflare described the takedown as part of a broader shift toward large-scale disruption of the actor’s infrastructure, and the group reportedly told customers to switch to new plans and offered extra subscription time to some victims.