Microsoft Takes Down 340 Domains Tied to Raccoon0365 Phishing Scheme
Microsoft Takes Down 340 Domains Tied to Raccoon0365 Phishing Scheme
Microsoft, backed by a Manhattan court order, shut 340 sites tied to Raccoon0365—a Nigerian phishing service turning crime into a subscription. It used Telegram to recruit members, earning $100k+ and harvesting thousands
Microsoft announced Tuesday that it had shut down almost 340 websites connected to Raccoon0365, a rapidly expanding Nigerian phishing service that allowed even unskilled actors to launch massive cyberattacks, according to Reuters. The takedown, which was supported by a Manhattan U.S. District Court order, highlights how phishing has become more industrialized, with turnkey subscription services lowering the bar for cybercrime.
Raccoon0365 allowed users to pose as well-known businesses and trick victims into providing their Microsoft login credentials by using a private Telegram group with over 850 paying members. According to Microsoft's Digital Crimes Unit, the service has harvested at least 5,000 user credentials and generated over $100,000 in cryptocurrency payments since its July 2024 launch.
"Cybercriminals don't need to be sophisticated to cause widespread harm," Microsoft assistant general counsel Steven Masada stated.
“Simple tools like Raccoon0365 make cybercrime accessible to virtually anyone, putting millions of users at risk.”
Microsoft identified Nigerian Joshua Ogundipe as the ringleader. The service targeted a variety of industries, including healthcare and finance, according to court documents. A concentrated wave of phishing attacks with a tax theme targeted 2,300 U.S. organizations in February 2025 alone.
One particular victim has been the healthcare industry. At least five healthcare organizations experienced successful credential breaches through Raccoon0365 campaigns, according to Errol Weiss, chief security officer of Health-ISAC, Microsoft's co-plaintiff.
“Once a cybercriminal has access to a network, it’s only up to their imagination how they monetize it,” Weiss warned.
Cloudflare collaborated with Microsoft and the US Secret Service to take down Raccoon0365 and prevent the creation of new accounts after inadvertently hosting parts of the backend. The case, according to security experts, shows how phishing-as-a-service has developed into a democratized business model where tools are offered in bulk and at low prices, turning ordinary people into cybercriminals.
