Microsoft and Cloudflare teamed up to dismantle the RaccoonO365 phishing service

Microsoft and Cloudflare disrupted the RaccoonO365 phishing operation, a phishing‑as‑a‑service platform used to steal Microsoft 365 credentials, with Microsoft’s Digital Crimes Unit seizing 338 websites and cutting off criminals’ access to victims. In a September 2025 operation, Cloudflare dismantled hundreds of domains and Worker accounts tied to RaccoonO365, a move that followed an August civil lawsuit filed by Microsoft.

According to Microsoft, the service was advertised for $355–$999 per subscription and was used to steal at least 5,000 Microsoft 365 credentials across 94 countries, with the service reportedly having 100–200 subscribers and earning over $100,000 in crypto. Each subscription enabled thousands of phishing emails daily, contributing to hundreds of millions of emails yearly.

RaccoonO365 has been used in tax scams against 2,300 U.S. organisations and at least 20 healthcare providers, risking delayed care, breached patient data and financial losses. Authorities have referred Nigerian national Joshua Ogundipe as leader of the scheme, and a leaked crypto wallet exposed their operations.