Microsoft disrupts RaccoonO365 phishing service, seizes 338 domains

Microsoft’s Digital Crimes Unit said on Tuesday it has disrupted a large phishing-as-a-service operation known as RaccoonO365 by seizing roughly 338 internet domains linked to the service under a court order from the U.S. District Court for the Southern District of New York. Microsoft said the takedown, carried out earlier this month with technical and investigative partners, severed the infrastructure of a Nigeria-based criminal enterprise that since July has been used to harvest more than 5,000 Microsoft credentials from users in 94 countries.

Microsoft described RaccoonO365 as a subscription service that enabled customers to send thousands of phishing emails daily, deploy fake Microsoft-branded emails, attachments, QR codes and websites, and capture login credentials and session cookies to bypass multifactor authentication. The kits were marketed through an invite-only Telegram channel with about 850 members and were used in widespread campaigns, including a tax-themed effort that targeted more than 2,300 mostly U.S. organizations between February 12 and February 28. Microsoft also said at least 20 U.S. health care organizations were targeted.