Nigeria Arrests Developer of RaccoonO365 Phishing Scheme Targeting Microsoft 365

The Nigeria Police Force National Cybercrime Centre (NPF–NCCC) recently announced the arrest of three individuals linked to a phishing operation targeting major corporations, particularly through the RaccoonO365 phishing-as-a-service (PhaaS) scheme. The principal suspect, Okitipi Samuel, also known as Moses Felix, was identified as the main developer of the phishing infrastructure. Investigations revealed that he operated a Telegram channel where phishing links were sold in exchange for cryptocurrency and hosted fraudulent Microsoft login portals using Cloudflare.

RaccoonO365 is associated with a financially motivated threat group that enables cybercriminals to conduct credential harvesting attacks by mimicking Microsoft 365 login pages. Microsoft has been actively tracking this threat actor, known as Storm-2246, and previously worked with Cloudflare to seize 338 domains used by RaccoonO365 in September 2025. Since July 2024, the phishing infrastructure has led to the theft of at least 5,000 Microsoft credentials from users in 94 countries.

The NPF reported that RaccoonO365 was utilized to create fraudulent Microsoft login portals aimed at stealing user credentials, which were then used to gain unauthorized access to email platforms of various institutions, including corporate, financial, and educational entities. This led to multiple incidents of business email compromise, data breaches, and financial losses across different jurisdictions between January and September 2025.

Additionally, a civil lawsuit filed by Microsoft and Health-ISAC in September 2025 accused several individuals of facilitating the cybercriminal operation by distributing and implementing the phishing kit. The stolen data is often used to fuel further cybercrimes, including financial fraud and ransomware attacks.

Understanding the Broader Cybersecurity Implications

This incident highlights the ongoing risks associated with phishing attacks, particularly those that leverage well-known platforms like Microsoft 365. Cybercriminals are increasingly sophisticated, using tools like RaccoonO365 to create convincing phishing schemes that can deceive even vigilant users.

Everyday users should be particularly cautious of emails and messages that prompt them to enter credentials, especially if they appear to come from legitimate services. Organizations must ensure they have robust security measures in place, such as multi-factor authentication and employee training on recognizing phishing attempts.

Monitoring account activity for unauthorized access and regularly updating passwords can also help mitigate risks associated with such phishing schemes. The collaboration between law enforcement and tech companies like Microsoft is crucial in combating these threats and protecting users from cybercrime.