Microsoft Disrupts Cybercrime Service RedVDS

Microsoft Disrupts Cybercrime Service RedVDS, detailing how RedVDS operated as a cybercrime-as-a-service marketplace that enabled mass phishing and hosted the infrastructure for fraud, including business email compromise schemes. According to Microsoft, the disruption involved seizing two domains hosting the RedVDS marketplace and customer portal, and the action was part of a coordinated effort with international law enforcement that aimed to take the service offline.

The operation is described as a large-scale endeavour, with RedVDS offering disposable virtual computers for criminal campaigns and averaging about 2,600 RedVDS virtual machines sending roughly 1 million phishing messages to Microsoft customers each day in a given month. Microsoft notes that since September, attackers have fraudulently accessed more than 191,000 organizations worldwide, though this represents only a subset of impacted accounts.

The company cites specific losses in at least two cases, including more than $7.3 million lost by H-2 Pharma and nearly $500,000 by the Gatehouse Dock Condominium Association in Florida, with the civil action filed in the US District Court for the Southern District of Florida. January 14, 2026.