{"id":59359,"date":"2025-09-16T21:33:59","date_gmt":"2025-09-16T21:33:59","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/microsoft-blocks-bait-for-fastest-growing-365-phish-kit-seizes-338-domains\/"},"modified":"2025-09-16T21:33:59","modified_gmt":"2025-09-16T21:33:59","slug":"microsoft-blocks-bait-for-fastest-growing-365-phish-kit-seizes-338-domains","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-blocks-bait-for-fastest-growing-365-phish-kit-seizes-338-domains\/","title":{"rendered":"Microsoft blocks bait for \u2018fastest-growing\u2019 365 phish kit, seizes 338 domains"},"content":{"rendered":"

Microsoft has seized 338 websites associated with RaccoonO365 and identified the leader of the phishing service – Joshua Ogundipe – as part of a larger effort to disrupt what Redmond’s Digital Crimes Unit calls the “fastest-growing tool used by cybercriminals to steal Microsoft 365 usernames and passwords.”<\/p>\n

The criminal operation sold subscriptions to its RaccoonO365 Suite of phishing kits<\/a>, ranging from a 30-day plan for $335 to a 90-day subscription for $999, via a private Telegram channel with more than 850 members, according to separate blogs from Steven Masada<\/a>, Microsoft’s DCU assistant general counsel, and Cloudflare<\/a>, which also participated in the website takedown.<\/p>\n

Since July 2024, these phishing kits have been used by other criminals to steal at least 5,000 Microsoft credentials from 94 countries, raking in at least $100,000 in cryptocurrency payments for Ogundipe and his affiliates, Masada said. “We estimate that this amount reflects approximately 100-200 subscriptions, which is likely an underestimate of the total subscriptions sold,” he added.<\/p>\n