Authorities in Nigeria have introduced the arrest of three “high-profile web fraud suspects” who’re alleged to have been concerned in phishing assaults concentrating on main companies, together with the principle developer behind the RaccoonO365 phishing-as-a-service (PhaaS) scheme.
The Nigeria Police Pressure Nationwide Cybercrime Centre (NPF–NCCC) stated investigations performed in collaboration with Microsoft and the Federal Bureau of Investigation (FBI) led to the identification of Okitipi Samuel, also referred to as Moses Felix, because the principal suspect and developer of the phishing infrastructure.
“Investigations reveal that he operated a Telegram channel via which phishing hyperlinks have been offered in alternate for cryptocurrency and hosted fraudulent login portals on Cloudflare utilizing stolen or fraudulently obtained electronic mail credentials,” the NPF stated in a publish shared on social media.
As well as, laptops, cellular gadgets, and different digital gear linked to the operation have been seized following search operations performed at their residences. The 2 different arrested people haven’t any connection to the creation or operation of the PhaaS service, per the NPF.
RaccoonO365 is the title assigned to a financially motivated risk group behind a PhaaS toolkit that permits dangerous actors to conduct credential harvesting assaults by serving phishing pages mimicking Microsoft 365 login pages. Microsoft is monitoring the risk actor below the moniker Storm-2246.
Again in September 2025, the tech large stated it labored with Cloudflare to grab 338 domains utilized by RaccoonO365. The phishing infrastructure attributed to the toolkit is estimated to have led to the theft of no less than 5,000 Microsoft credentials from 94 nations since July 2024.
The NPF stated RaccoonO365 was used to arrange fraudulent Microsoft login portals geared toward stealing person credentials and utilizing them to realize illegal entry to the e-mail platforms of company, monetary, and academic establishments. The joint probe has uncovered a number of incidents of unauthorized Microsoft 365 account entry between January and September 2025 that originated from phishing messages crafted to imitate authentic Microsoft authentication pages.
These actions led to enterprise electronic mail compromise, data breaches, and monetary losses throughout a number of jurisdictions, the NPF added.
A civil lawsuit filed by Microsoft and Well being-ISAC in September has accused defendants Joshua Ogundipe and 4 different John Does of internet hosting a cybercriminal operation by “promoting, distributing, buying, and implementing” the phishing package to facilitate subtle spear-phishing and siphon delicate data.
The stolen information is then used to gasoline extra cybercrimes, together with enterprise electronic mail compromise, monetary fraud, and ransomware assaults, in addition to commit mental property violations.
The event comes as Google filed a lawsuit in opposition to the operators of the Darcula PhaaS service, naming Chinese language nationwide Yucheng Chang because the group’s chief together with 24 different members. The corporate is searching for a court docket order to grab the group’s server infrastructure that has been behind a large smishing wave impersonating U.S. authorities entities.
Information of the lawsuit was first reported by NBC Information on December 17, 2025. The event comes a bit of over a month after Google additionally sued China-based hackers related to one other PhaaS service often known as Lighthouse that is believed to have impacted over 1 million customers throughout 120 nations.
