Loading story…
Nigerian authorities have arrested Okitipi Samuel, also known as Moses Felix, identified as a principal developer behind the RaccoonO365 phishing-as-a-service (PhaaS) operation. The arrest, conducted by the Nigeria Police Force National Cybercrime Centre (NPF–NCCC) in collaboration with Microsoft, the FBI, and the U.S. Secret Service, followed coordinated raids in Lagos and Edo states. Investigators seized laptops, mobile devices, and other digital equipment linked to the operation, and determined that Samuel operated a Telegram channel to sell phishing links for cryptocurrency and hosted fraudulent Microsoft 365 login portals on Cloudflare using stolen or fraudulently obtained credentials. Two other individuals were also arrested but were not connected to the creation or operation of the PhaaS service.
RaccoonO365 is a subscription-based phishing kit that enabled cybercriminals to create convincing Microsoft-branded phishing pages, emails, and attachments, facilitating credential harvesting attacks against corporate, financial, and educational institutions worldwide. The toolkit, tracked by Microsoft as Storm-2246, was used to target thousands of email addresses daily and included features to bypass multifactor authentication. In September 2025, Microsoft and Cloudflare collaborated to seize 338 domains associated with the operation, which is estimated to have compromised at least 5,000 Microsoft credentials across 94 countries since July 2024. The takedown highlights ongoing efforts by law enforcement and private sector partners to disrupt large-scale phishing infrastructure and the cybercriminal ecosystem supporting it.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Nigerian authorities arrested three internet fraud suspects, including Okitipi Samuel, also known as Moses Felix, who is believed to be the main developer of RaccoonO365. The arrests followed a joint investigation involving the Nigeria Police Force National Cybercrime Centre, Microsoft, the FBI, and reporting also cited the U.S. Secret Service.
Separately, Google filed lawsuits against operators of the Darcula and Lighthouse phishing-as-a-service platforms, including Chinese nationals, seeking to seize infrastructure used in large-scale smishing and phishing campaigns. These actions were reported alongside the RaccoonO365 case.
Microsoft and Health-ISAC filed a civil lawsuit against additional individuals accused of distributing the RaccoonO365 phishing kit. The legal action accompanied broader efforts to dismantle the phishing ecosystem behind the attacks.
The operators marketed the subscription-based phishing kit and phishing links through a Telegram channel with more than 800 members. The service used Cloudflare-hosted fraudulent Microsoft 365 login pages and was reportedly used heavily by Russia-based cybercriminals.
In September 2025, Microsoft and Cloudflare coordinated to seize domains and websites tied to the RaccoonO365 phishing service. The disruption targeted infrastructure used to host fake Microsoft 365 login portals and support credential theft operations.
Since July 2024, the RaccoonO365 phishing-as-a-service operation has stolen at least 5,000 Microsoft credentials across 94 countries. The kit was used to create fake Microsoft 365 login portals, enabling business email compromise, data breaches, and financial losses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and Cloudflare coordinated the takedown of RaccoonO365, a major phishing-as-a-service platform used to steal Microsoft 365 credentials. The operation involved seizing 338 domains and identifying Nigerian national Joshua Ogundipe as the leader. RaccoonO365 enabled cybercriminals to bypass MFA, target thousands of organizations, and facilitated large-scale credential theft and fraud.
Jun 29, 2026
Ukrainian national **Mark Sokolovsky** was sentenced to five years in prison for his role in operating **Raccoon Stealer**, a malware-as-a-service infostealer that prosecutors said was rented to other criminals for **$75 per week** or **$200 per month** in cryptocurrency. U.S. authorities said the platform infected millions of computers and stole more than **52 million credentials** along with cryptocurrency wallets, payment card data, email records, and other sensitive information later used in fraud, identity theft, and ransomware attacks. Sokolovsky was arrested in the Netherlands in March 2022, extradited to the United States in February 2024, and later pleaded guilty after being charged with fraud, money laundering, and aggravated identity theft. The case followed a coordinated FBI and European law enforcement operation that dismantled Raccoon Stealer infrastructure in the Netherlands and Italy and led to the launch of the FBI victim-notification portal at `raccoon.ic3.gov`. Independent research by Team Cymru linked Raccoon’s management activity to **Kharkiv, Ukraine**, identified a Tor-based customer panel and Telegram update server, and tied the operation to the **CC2BTC** stolen-card marketplace, suggesting the operators monetized victim data both by leasing the malware and by reselling stolen payment cards. Despite the takedown, the malware family later resurfaced as **Recordbreaker**, also described as **Raccoon Stealer v2**, with a rewritten codebase and updated delivery and exfiltration features.
Aug 15, 2026
German authorities, supported by the United States and Indonesia, dismantled the main infrastructure behind the **Kratos** phishing-as-a-service platform and reportedly neutralized more than 200 servers, while Indonesian authorities arrested the alleged developer and technical administrator. Investigators said the kit had been used by more than 1,800 criminal groups to launch roughly 15,000 phishing campaigns each month across more than 30 countries, primarily targeting organizations in the US and Europe. Also tracked as **SneakyLog** and **Sneaky 2FA**, Kratos was designed to steal credentials and session cookies through convincing Microsoft-themed phishing pages, enabling attackers to bypass multifactor authentication and compromise Microsoft 365 accounts. Threat reporting had previously tied Kratos to broad phishing waves using lures themed around tax documents, IRS notices, CPA requests, and cryptocurrency tax forms, with victims spanning financial services, healthcare, education, retail, manufacturing, technology, law firms, schools, and SMBs. Campaigns impersonated services including **SharePoint**, **OneDrive**, **Microsoft Forms**, **Canva**, **Tilda**, and **Adobe**, and used evasive delivery methods such as QR codes, OneNote and Excel attachments, URL shorteners, cloud-hosted pages, and bot filtering. In one IRS-themed campaign, attackers targeted more than 29,000 users across 10,000 organizations and delivered a malicious **ScreenConnect**-based "Transcript Viewer" executable, showing how credential theft operations tied to Kratos also supported broader post-compromise access.
Jul 24, 2026