By 
Microsoft, in partnership with Cloudflare and the US Secret Service, has dismantled 338 websites linked to a Nigerian-led phishing network, RaccoonO365, highlighting how subscription-based tools are enabling a new wave of cybercrime. The operation targets a network responsible for stealing thousands of Microsoft 365 credentials and disrupting critical sectors worldwide.
The company’s Digital Crimes Unit (DCU) obtained a court order from the Southern District of New York to seize the domains, effectively dismantling RaccoonO365’s technical infrastructure. The network allowed even low-skilled actors to impersonate official communications and harvest login credentials from unsuspecting users.
Since its launch in July 2024, RaccoonO365 has stolen more than 5 000 Microsoft credentials across 94 countries, generating over $100 000 in cryptocurrency. The network operated through a private Telegram channel with over 850 subscribers, offering tiered subscriptions that enabled users to target up to 9 000 email addresses per day.
By Ruvarashe Gora
The phishing network has had global repercussions, including a tax-themed campaign in February 2025 that targeted more than 2 300 organisations, among them at least 20 healthcare providers in the United States. Experts warn that compromised credentials can open the door to extensive damage, from financial theft to data breaches.
Cloudflare, whose services were exploited by the network to mask its operations, also took steps to disrupt the infrastructure. Security analysts say the takedown underscores the risks and responsibilities facing rapidly digitising economies like Nigeria. As Africa’s largest economy expands in fintech and cloud adoption, its association with one of the world’s fastest-growing cybercrime rings raises urgent questions about cyber governance and reputation.
Authorities caution that the RaccoonO365 seizure represents just the tip of the iceberg. The accessibility of such phishing-as-a-service platforms could accelerate the spread of cyber threats, putting millions of users at risk globally.
Comments