Microsoft Disrupts 'RaccoonO365' Phishing Service

Microsoft and Cloudflare teamed up to disrupt the phishing service known as RaccoonO365, with Microsoft noting that 338 websites linked to the operation were seized under a court order in the Southern District of New York. According to Cloudflare, which partnered with Microsoft and US law enforcement, the operation involved a threat group tracked as Storm-2246 and described RaccoonO365 as the fastest-growing tool for stealing Microsoft 365 usernames and passwords.

Since July 2024, the kits have been used to steal at least 5,000 credentials from 94 countries, and the service was used to target more than 2,300 organisations in the US, including at least 20 US healthcare organisations.

A subscription allowed up to 9,000 email addresses to be targeted, with pricing showing a $600 annual fee and 30- and 60-day licences, plus an AI-powered service named “RaccoonO365 AI-MailCheck.” The DCU identified Nigerian-born mastermind Joshua Ogundipe, with Masada noting at least $100,000 in cryptocurrency and around 100 to 200 subscriptions, while Microsoft described the operation as having an organised, company-like structure.