Microsoft has taken control of nearly 340 websites in Nigeria that were linked to a phishing operation called Raccoon0365. The company said it got an order from a U.S. District Court in Manhattan earlier this month to seize the domains.
According to Microsoft, these sites stole login information from at least 5,000 Microsoft users. The phishing service was run through a private Telegram channel with more than 850 members. It allowed users to pretend to be trusted brands and trick people into entering their Microsoft credentials on fake login pages.
Since its launch in July 2024, the service has earned its operators over $100,000 in cryptocurrency. Microsoft said the domains were seized over several days this month.
Steven Masada, Assistant General Counsel in Microsoft’s Digital Crimes Unit, said that simple tools like Raccoon0365 make it easy for criminals to reach many people. He added that the company saw Raccoon0365 send tax-themed phishing emails to more than 2,300 organisations between February 12 and February 28 this year. The majority of those targets were in the United States.
Among the organisations targeted were many in the health sector. At least five healthcare providers had their credentials harvested successfully and about 25 health-sector organisations overall were hit. Microsoft said it is working with partners like Cloudflare and others to remove malicious network infrastructure, stop revenue flows to the actors involved and prevent them from rebuilding operations
Emmanuel Onwuka