{"id":5303,"date":"2025-09-17T06:52:43","date_gmt":"2025-09-17T06:52:43","guid":{"rendered":"https:\/\/prepsaret.com\/news\/?p=5303"},"modified":"2025-09-17T06:55:05","modified_gmt":"2025-09-17T06:55:05","slug":"microsoft-cracks-down-on-340-sites-powering-phishing-subscription-network","status":"publish","type":"post","link":"https:\/\/prepsaret.com\/news\/microsoft-cracks-down-on-340-sites-powering-phishing-subscription-network\/","title":{"rendered":"Microsoft Cracks Down on 340 Sites Powering Phishing Subscription Network"},"content":{"rendered":"

Microsoft Inc announced on Tuesday that it has taken control of nearly 340 websites linked to a fast-growing Nigerian-based platform accused of enabling widespread phishing schemes.\u00a0<\/span><\/p>\n

The company reported that the operation had compromised at least 5,000 Microsoft account credentials.<\/span><\/p>\n

Earlier this month, Microsoft secured authorization from the U.S. District Court in Manhattan to seize domains tied to \u201cRaccoon0365,\u201d a subscription-based service designed to facilitate large-scale phishing.\u00a0<\/span><\/p>\n

Steven Masada, assistant general counsel with Microsoft\u2019s Digital Crimes Unit, explained that the service allowed clients to launch email blasts in the thousands.\u00a0<\/span><\/p>\n

Writing in a company blog, Masada said Raccoon0365 was run through a private Telegram group with over 850 members, giving them tools to mimic trusted brands and trick people into providing their Microsoft login details on counterfeit sign-in pages.<\/span><\/p>\n

Since its launch in July 2024, the service has generated at least $100,000 in cryptocurrency for its operators, according to Masada. Microsoft confirmed that the website seizures took place over several days this month.<\/span><\/p>\n

Related story: <\/b>Sen. Wyden Urges FTC Probe Into Microsoft Over Alleged Cybersecurity Failures<\/span><\/a><\/p>\n

Identified Leader and Global Reach<\/b><\/h2>\n

Court documents name Nigeria-based Joshua Ogundipe as the primary operator behind Raccoon0365. Efforts to reach him for comment via the email address listed in Microsoft\u2019s filings went unanswered.\u00a0<\/span><\/p>\n

Highlighting the scale of the threat, Masada stressed: \u201cCybercriminals don\u2019t need to be sophisticated to cause widespread harm. Simple tools like Raccoon0365 make <\/span>cybercrime <\/span><\/a>accessible to virtually anyone, putting millions of users at risk.\u201d<\/span><\/p>\n

According to Microsoft<\/a>, the service has been used to target a wide range of sectors, with filings indicating that \u201ca significant portion\u201d of its campaigns were directed at New York City-based organizations.\u00a0<\/span><\/p>\n

In one instance, Microsoft traced a February phishing push using fraudulent tax-related emails that sought to compromise more than 2,300 organizations, mostly in the U.S.<\/span><\/p>\n

Errol Weiss, chief security officer of the <\/span>Health Information Sharing & Analysis Center (Health-ISAC)<\/span><\/a>, which joined Microsoft in the case, noted that Raccoon0365 had already been linked to stolen login data from at least five healthcare entities, while aiming at 25 health organizations overall.\u00a0<\/span><\/p>\n

\u201cSo many of the attacks start because somebody gave up their user name and password to a bad guy,\u201d Weiss said. \u201cOnce that cybercriminal has access to the network, then it’s just up to the imagination in terms of what comes next and how they monetize it.\u201d<\/span><\/p>\n

Cloudflare, whose services had been used to mask Raccoon0365\u2019s infrastructure, confirmed in a blog post that it collaborated with Microsoft and the U.S. Secret Service to disrupt the group\u2019s activities.\u00a0<\/span><\/p>\n

Blake Darch\u00e9, Cloudflare\u2019s head of threat intelligence, acknowledged in an interview that while the operators made \u201csome key operational security mistakes,\u201d they nonetheless proved highly effective.<\/span><\/p>\n

Read next:<\/b> Musk\u2019s Starlink Restores Service After Brief Outage<\/span><\/a><\/p>\n

Also Important Headlines:<\/b><\/p>\n