Loading story…
Microsoft and Cloudflare coordinated the takedown of RaccoonO365, a major phishing-as-a-service platform used to steal Microsoft 365 credentials. The operation involved seizing 338 domains and identifying Nigerian national Joshua Ogundipe as the leader. RaccoonO365 enabled cybercriminals to bypass MFA, target thousands of organizations, and facilitated large-scale credential theft and fraud.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A threat cluster was reported to be running an extortion campaign that used social engineering tactics and a 'Raccoon' persona to pressure targets. This appears to mark the public disclosure of the campaign and its tradecraft.
Initial story creation
Microsoft published a blog post describing actions targeting the cybercrime supply chain. This appears to be an earlier public disclosure relevant to the threat activity later associated with the extortion campaign using the 'Raccoon' persona.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nigerian authorities have arrested Okitipi Samuel, also known as Moses Felix, identified as a principal developer behind the RaccoonO365 phishing-as-a-service (PhaaS) operation. The arrest, conducted by the Nigeria Police Force National Cybercrime Centre (NPF–NCCC) in collaboration with Microsoft, the FBI, and the U.S. Secret Service, followed coordinated raids in Lagos and Edo states. Investigators seized laptops, mobile devices, and other digital equipment linked to the operation, and determined that Samuel operated a Telegram channel to sell phishing links for cryptocurrency and hosted fraudulent Microsoft 365 login portals on Cloudflare using stolen or fraudulently obtained credentials. Two other individuals were also arrested but were not connected to the creation or operation of the PhaaS service. RaccoonO365 is a subscription-based phishing kit that enabled cybercriminals to create convincing Microsoft-branded phishing pages, emails, and attachments, facilitating credential harvesting attacks against corporate, financial, and educational institutions worldwide. The toolkit, tracked by Microsoft as Storm-2246, was used to target thousands of email addresses daily and included features to bypass multifactor authentication. In September 2025, Microsoft and Cloudflare collaborated to seize 338 domains associated with the operation, which is estimated to have compromised at least 5,000 Microsoft credentials across 94 countries since July 2024. The takedown highlights ongoing efforts by law enforcement and private sector partners to disrupt large-scale phishing infrastructure and the cybercriminal ecosystem supporting it.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026
Huntress reported a large phishing operation that used **Railway** cloud infrastructure to compromise Microsoft 365 accounts at hundreds of organizations by abusing Microsoft's legitimate device authorization flow. The campaign harvested and replayed OAuth access and refresh tokens, allowing attackers to maintain access for up to 90 days without needing victims' passwords and in many cases without being stopped by MFA. Researchers identified at least **344-350 victim organizations** across the U.S., Canada, Australia, New Zealand, and Germany, with activity accelerating sharply in early March and continuing at a rate of more than 50 compromises per day even after initial disruption efforts. The operation used highly varied, likely **AI-generated** lures delivered through email, QR codes, file-share themes, compromised websites, multi-hop redirects, and `workers.dev` pages to evade filtering and scale quickly. Huntress linked the activity to the **EvilTokens** phishing-as-a-service platform, which advertised Office 365 capture links, SMTP delivery, B2B sender services, AI-assisted phishing workflows, and open redirects. In response, Huntress pushed Conditional Access protections to about **60,000 Microsoft cloud tenants**, blocked additional attack attempts, and urged defenders to prioritize identity-layer monitoring, token revocation, blocking Railway-owned infrastructure, restricting device code authentication, and enabling **Continuous Access Evaluation**.
Jun 29, 2026