Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft says it disrupted RaccoonO365, a subscription phishing service also tracked as Storm-2246, after obtaining a court order to seize 338 associated websites on September 16, 2025. The company says the service sold automated kits that impersonated Microsoft, stole at least 5,000 credentials in 94 countries, and used techniques intended to circumvent multifactor authentication (MFA). Microsoft later reported multiple arrests in Nigeria, but the 2025 case itself was a civil action and its allegations are not final findings of liability.
What RaccoonO365 was
Microsoft describes RaccoonO365 as a subscription-based phishing operation. Customers paid to use reusable kits rather than building individual campaigns from scratch. Microsoft tracked the operation as Storm-2246.
The kits imitated Microsoft communications and directed targets to fraudulent pages. Campaign components included deceptive emails, attachments and websites designed to persuade recipients to submit account credentials. Microsoft’s January 2026 retrospective said investigators found social engineering—not an exploit of a vulnerability in Microsoft’s technology—at the center of the operation.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Examples of the impersonation techniques
Microsoft’s retrospective cites CAPTCHA pages and the lookalike domain rnicrosoft.com as examples used in the operation. Those examples illustrate the approach; Microsoft does not say that every campaign used that exact domain or lure.
#1 Best Overall
How Microsoft disrupted the service
The September 2025 court action
On September 16, 2025, Microsoft’s Digital Crimes Unit announced that it had obtained an order from the U.S. District Court for the Southern District of New York and seized 338 websites associated with RaccoonO365.
The legal notice identifies Microsoft Corporation and Health-ISAC as plaintiffs, and Joshua Ogundipe and Does 1–4 as defendants. It describes a civil lawsuit alleging unlawful deception, unauthorized intrusion and intellectual-property violations. Microsoft sought a temporary restraining order and other injunctive relief. Those allegations and requests should not be read as a final judgment that the defendants were liable.
Microsoft cautioned that filing a lawsuit is only the beginning because operators may attempt to rebuild their infrastructure. Seizing domains can interrupt delivery, payment and administration, but it does not by itself eliminate copies of phishing tools or the people operating them.
Later arrest reporting
In a retrospective published January 20, 2026, Microsoft said local law enforcement had made multiple arrests in Nigeria. The company named Joshua Ogundipe and suspected ringleader Okitipi Samuel among those arrested. This is Microsoft’s later account of enforcement activity, separate from the September 2025 civil domain seizure.
Rank #3
What Microsoft says the service stole and how large it became
Microsoft’s investigation findings describe a system built for scale. The figures below are Microsoft’s incident-specific estimates and reports, not independently audited totals.
| Measure | Microsoft’s reported figure | Qualification |
|---|---|---|
| Credentials stolen | At least 5,000 | Microsoft says these credentials spanned 94 countries from July 2024 onward. |
| Websites seized | 338 | Domains seized under the Southern District of New York court order announced September 16, 2025. |
| Daily targeting capacity | Up to 9,000 email addresses | Maximum target list capacity Microsoft attributes to the kits. |
| Telegram community | More than 850 members | Member count reported by Microsoft for the service’s Telegram group. |
| Cryptocurrency payments | At least US$100,000 | Microsoft estimated this represented roughly 100–200 subscriptions and warned the amount could be an underestimate. |
| Healthcare organizations targeted | At least 20 in the United States | Microsoft’s reported count of targeted healthcare organizations. |
| Phishing email volume | Hundreds of millions over one year | Figure reported in Microsoft’s January 2026 retrospective. |
A stolen credential is evidence of credential theft, not proof that every account was used to enter a network, access data or commit fraud. The available figures also describe this particular operation; they are not a measurement of phishing as a whole.
How the kits attempted to bypass MFA
Microsoft says RaccoonO365 used methods to circumvent MFA. In a typical social-engineering flow, a victim is persuaded to visit a convincing sign-in page, while the attacker uses the captured information and interaction with the real service to continue authentication. The exact sequence can vary by campaign and target.
MFA therefore remains important but is not an absolute barrier when a person is tricked into approving an unexpected request or when an attacker captures information during a fraudulent sign-in process. Microsoft’s account of RaccoonO365 does not claim that one universal bypass worked against every MFA configuration.
Best Value
Why the operation mattered beyond Microsoft accounts
Healthcare disruption risk
Microsoft says at least 20 U.S. healthcare organizations were targeted. Stolen identities in healthcare can become an initial entry point for incidents affecting clinical systems, scheduling, billing, communications and sensitive records. Sean Farrell, assistant general counsel for Microsoft’s Digital Crimes Unit, described phishing as “the initial entry vector for a lot of harm that’s done in the healthcare industry.”
Cybercrime as a subscription business
RaccoonO365 lowered the technical and organizational barrier to running campaigns. A customer could supply a large target list, select prepared impersonation material and use infrastructure maintained by the service. Farrell called it “the fast-food franchise version of cybercrime.” The subscription model helps explain why a single operation could involve hundreds of customers, large email volumes and targets in many countries.
Downstream compromise is not automatic
The operation’s reported scale indicates exposure and attempted theft, not a confirmed breach of every named organization or account. Whether a stolen credential led to access depended on factors such as password reuse, conditional-access policies, session protections, user reporting and the speed of defensive response.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What organizations and users can do
- Use phishing-resistant MFA where available. Hardware-backed or passkey-based methods can reduce the value of credentials captured by lookalike pages, while still requiring careful handling of unexpected prompts.
- Inspect domains before signing in. A familiar logo, CAPTCHA or email style does not establish that a page is genuine. Check the complete domain and navigate through a known bookmark or the organization’s normal portal instead of an unsolicited link.
- Maintain anti-phishing protections. Keep mail filtering, browser protections, endpoint security and identity-risk detection current, and configure conditional access to limit unusual sign-ins.
- Train users on social engineering. Explain that attackers may imitate login pages, attachments, help-desk messages and MFA prompts. Make reporting a normal, low-friction action.
- Respond quickly to suspected exposure. Revoke sessions and tokens, reset credentials, review sign-in and mailbox activity, check forwarding rules and investigate related accounts or systems.
- Protect high-impact services. Healthcare and other critical organizations should rehearse identity-compromise procedures because phishing can precede operational disruption even when no software vulnerability was exploited.
What the takedown does—and does not—establish
The September 2025 seizure shows a court-authorized intervention against infrastructure Microsoft associated with RaccoonO365. It does not establish that every domain, customer or incident attributed to the service had the same operator or outcome. The civil complaint records Microsoft’s claims and requested remedies; final responsibility requires judicial or other lawful determinations.
Microsoft’s January 2026 update adds reported arrests and investigation context, but arrests are allegations in progress, not convictions. The practical lesson is narrower and more durable: phishing-as-a-service can industrialize social engineering, and taking down domains must be paired with identity controls, user education and incident response.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
