A sophisticated Nigerian cybercrime syndicate known as “Raccoon 0365” has been dismantled following a coordinated international takedown.
The group, which specialized in a highly lucrative and damaging niche—creating counterfeit Microsoft 365 login pages—acted as a critical support system for fraudsters worldwide, generating over $100,000 by renting out its deceptive infrastructure.
Since its establishment in July 2024, the group’s operations have had a staggering global reach, enabling scammers in 94 countries to harvest login credentials through meticulously crafted phishing expeditions.
The modus operandi of Raccoon 0365 was both simple and devastatingly effective. The group designed and hosted flawless replicas of official Microsoft 365 login portals. These fake pages were then rented out to other cybercriminals, who used them in phishing campaigns to trick victims into surrendering their usernames and passwords.
The primary targets were not random individuals but carefully selected organizations, with tech startups and HR companies that handle sensitive financial data being particularly prized.
Once in possession of these credentials, the threat actors could perpetrate Business Email Compromise (BEC) scams, often leading to unauthorized wire transfers, data theft, and massive financial losses for the victim companies.
The scale of the operation was vast. Investigations revealed that the group was responsible for stealing more than 5,000 login credentials, fueling a wave of corporate account takeovers.
The takedown operation, which culminated on September 16, 2025, resulted in a decisive strike against this criminal enterprise. A total of 338 fraudulent websites operated by Raccoon 0365 were seized and deactivated, severing the tool that scammers relied upon.
While the digital infrastructure has been erased, the hunt for the human masterminds behind the operation is now intensifying, with authorities working toward their prosecution. This successful operation highlights the evolving, service-based nature of modern cybercrime and the critical importance of international collaboration in protecting the digital landscape from highly organized and specialized threat groups.
