Microsoft Takes Down 300+ Websites Behind RaccoonO365 Phishing Scheme

According to Microsoft’s Digital Crimes Unit (DCU), its action seized control of 338 websites facilitating RaccoonO365, a phishing-as-a-service platform used to harvest Microsoft 365 credentials. Acting under a court order from the Southern District of New York, the DCU disrupted the operation’s technical infrastructure, denying criminals access to victims and cutting off revenue streams.

The scheme, tracked by Microsoft as Storm-2246, offers tiered subscriptions that enable users with varying levels of technical skill to launch large-scale phishing campaigns, with the service now supporting up to 9,000 target addresses per day and including tools to bypass multi-factor authentication.

Since July 2024, its clients have stolen at least 5,000 Microsoft credentials across 94 countries, including a tax-themed campaign that infiltrated over 2,300 organisations in the United States and compromised at least 20 U.S. healthcare entities. Investigations identified Nigeria-based developer Joshua Ogundipe as a primary author of the code, while the DCU has been supported by Cloudflare and Health-ISAC, and plans to use blockchain analytics to trace illicit proceeds.