Microsoft and Cloudflare dismantle global RaccoonO365 phishing service
The group is believed to have stolen at least 5,000 Microsoft credentials from 94 countries
Microsoft and Cloudflare have jointly dismantled a sprawling Phishing-as-a-Service (PhaaS) operation known as RaccoonO365, which facilitated the theft of thousands of Microsoft 365 credentials across nearly 100 countries.
According to Microsoft, the group behind RaccoonO365, tracked internally as Storm-2246, has been active since at least July 2024, selling ready-to-deploy phishing kits to cybercriminals around the globe.
On 2nd September, Microsoft's Digital Crimes Unit (DCU), working with Cloudflare's Cloudforce One and Trust and Safety teams, initiated a coordinated strike.
Using a court order granted by the Southern District of New York, the DCU seized 338 websites and Cloudflare Worker accounts tied to the operation.
"This case shows that cybercriminals don't need to be sophisticated to cause widespread harm - simple tools like RaccoonO365 make cybercrime accessible to virtually anyone, putting millions of users at risk," said Steven Masada, assistant general counsel at Microsoft's DCU.
Microsoft banned identified domains, placed 'phish warning' interstitials in front of them, terminated associated Workers scripts, and suspended malicious user accounts. The actions were fully completed by 8th September.
Microsoft's investigation revealed that RaccoonO365 phishing kits were used in a range of high-impact attacks. A tax-themed campaign in April 2025 targeted more than 2,300 organisations in the United States, while at least 20 healthcare providers were also victims.
Overall, the group is believed to have stolen at least 5,000 Microsoft credentials from 94 countries. Victims' data, ranging from OneDrive files to SharePoint content and corporate email accounts, was later monetised in financial fraud, extortion attempts, or sold as initial access for ransomware groups.
Subscription business model
RaccoonO365 operated much like a SaaS startup, except that its business was cybercrime. Microsoft reported that the group rented its phishing kits via a private Telegram channel with over 840 members as of 25th August.
Subscriptions were sold in tiers: $355 for 30 days and $999 for 90 days, with payments accepted in Tether (USDT on TRC20, BEP20, and Polygon networks) or Bitcoin.
Microsoft estimates the group has earned at least $100,000 in cryptocurrency, suggesting between 100 and 200 subscriptions, though investigators caution the true number is "likely much higher."
The company identified the leader of RaccoonO365 as Joshua Ogundipe, a Nigerian national with a background in computer programming. According to Masada, Ogundipe personally authored much of the kit's code.
The attribution came after an operational security lapse exposed a cryptocurrency wallet linked to Ogundipe. Microsoft has referred the case to international law enforcement.
Ogundipe and four co-conspirators remain at large.
Cloudflare added that the operation likely collaborated with Russian-speaking cybercriminals, noting that the service's Telegram bot carried a Russian name.
Despite the takedown, the operators of RaccoonO365 have already announced plans to regroup. In a message to customers, they said they are "scrapping all legacy RaccoonO365 links" and instructed those with active subscriptions to upgrade to new plans.
To appease subscribers, the group promised an extra week of service to those who had paid for one-month access.
Cloudflare said the takedown was not just about cutting off existing infrastructure but also about raising operational costs for malicious actors.
Dismantling of RaccoonO365 follows another large-scale action in May 2025, when Microsoft seized more than 2,300 domains tied to the Lumma malware-as-a-service (MaaS) platform.