Phishing sites seized by Microsoft in major crackdown

"Microsoft has intensified its efforts to combat cybercrime by targeting Raccoon0365, a subscription-based phishing service that enabled wide-scale credential theft. Working through the U.S. District Court in Manhattan, the company successfully obtained approval to seize nearly 340 internet domains associated with fraudulent login pages. The campaign represents one of Microsoft's largest actions against organized phishing operations in recent years. By dismantling the domains, investigators sought to interrupt the infrastructure behind ongoing attacks that were impacting businesses, healthcare providers, and individuals across the United States."

"Raccoon0365 distinguished itself by using a subscription system. For recurring fees, subscribers gained access to pre-built phishing infrastructure, including login templates, automated distribution tools, and hosting services. According to Microsoft, more than 850 individuals subscribed to the service through a private Telegram channel. The arrangement significantly lowered the barriers to conducting cybercrime, allowing less technically skilled participants to run phishing campaigns at scale."

"Legal filings identified Nigerian national Joshua Ogundipe as the organizer of Raccoon0365. Court documents suggested Ogundipe and his collaborators had managed operations since mid-2024, offering phishing kits and email templates to paying members. The domains seized were central to the group's activity, often disguised to resemble Microsoft Outlook and Office 365 login pages. Victims who entered their credentials unknowingly handed over access to attackers, allowing unauthorized entry into email accounts and corporate networks."

Microsoft obtained court approval from the U.S. District Court in Manhattan to seize nearly 340 internet domains tied to Raccoon0365. Investigators aimed to disrupt infrastructure behind ongoing phishing campaigns that targeted businesses, healthcare providers, and individuals across the United States. Legal filings named Nigerian national Joshua Ogundipe as the organizer and described operations since mid-2024 offering phishing kits and email templates. The fraudulent domains often mimicked Microsoft Outlook and Office 365 login pages, capturing credentials that allowed unauthorized access to email accounts and corporate networks. Raccoon0365 used a subscription model with pre-built templates, automated distribution tools, and hosting, lowering barriers for over 850 subscribers.

Read at App Developer Magazine