RaccoonO365 Microsoft 365 credential-harvesting phishing campaign
Campaign
Summary
Hide ▲
Show ▼
The RaccoonO365 phishing operation drove repeated Microsoft 365 account compromises and created follow-on risk of business email compromise across corporate, financial, and educational institutions. Investigators tied the activity to phishing messages that mimicked legitimate Microsoft authentication pages and to fraudulent login portals used to steal credentials. The operation mattered because it turned stolen access into broader fraud and breach exposure across 94 countries.
Related Happenings
Kali365 Microsoft 365 device-code phishing campaign
Campaign
First: 25.05.2026 15:45
Last: 25.05.2026 15:45
Sources 1
About this happening:
A **Kali365** phishing campaign is targeting **Microsoft 365** environments worldwide with **device-code login lures**, putting accounts at risk of **token theft** and **MFA bypas...
Kali365 Microsoft 365 device-code phishing campaign
CampaignAbout this happening: A **Kali365** phishing campaign is targeting **Microsoft 365** environments worldwide with **device-code login lures**, putting accounts at risk of **token theft** and **MFA bypas...
Storm-2949 Microsoft 365 and Azure data-theft campaign
Campaign
First: 19.05.2026 22:35
Last: 19.05.2026 22:35
Sources 1
About this happening:
The **Storm-2949** campaign is targeting **Microsoft 365 and Azure production environments** to steal sensitive data, increasing the risk of privileged-account takeover and cloud...
Storm-2949 Microsoft 365 and Azure data-theft campaign
CampaignAbout this happening: The **Storm-2949** campaign is targeting **Microsoft 365 and Azure production environments** to steal sensitive data, increasing the risk of privileged-account takeover and cloud...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal Action
First: 19.05.2026 18:00
Last: 19.05.2026 18:00
Sources 1
About this happening:
Microsoft filed a **civil action** against **Fox Tempest** in the **US District Court for the Southern District of New York**, securing a **court order** that enabled a broad disr...
Microsoft civil action against Fox Tempest infrastructure takedown
Regulatory/Legal ActionAbout this happening: Microsoft filed a **civil action** against **Fox Tempest** in the **US District Court for the Southern District of New York**, securing a **court order** that enabled a broad disr...
Code of conduct-themed Microsoft AiTM phishing campaign
Campaign
First: 05.05.2026 09:35
Last: 05.05.2026 09:35
Sources 1
About this happening:
A **large-scale phishing campaign** used code of conduct-themed lures and **legitimate email services** to push victims to attacker-controlled domains and steal **authentication t...
Code of conduct-themed Microsoft AiTM phishing campaign
CampaignAbout this happening: A **large-scale phishing campaign** used code of conduct-themed lures and **legitimate email services** to push victims to attacker-controlled domains and steal **authentication t...
Scattered Spider 2022 SMS phishing campaign targeting technology companies
Campaign
First: 21.04.2026 17:53
Last: 21.04.2026 17:53
Sources 1
About this happening:
Tyler Robert Buchanan’s guilty plea newly confirms **Scattered Spider**’s **2022 SMS phishing campaign**, showing it reached **at least a dozen major technology companies** and en...
Scattered Spider 2022 SMS phishing campaign targeting technology companies
CampaignAbout this happening: Tyler Robert Buchanan’s guilty plea newly confirms **Scattered Spider**’s **2022 SMS phishing campaign**, showing it reached **at least a dozen major technology companies** and en...
Timeline
-
19.12.2025 21:05 1 articles · 5mo ago
Nigeria arrests three suspects tied to Raccoon0365
Legal Policy Action UpdateNigeria Police Force National Cybercrime Centre (NPF–NCCC) arrested three suspects linked to Raccoon0365, including Okitipi Samuel, also known as RaccoonO365 and Moses Felix, whom police believe developed the phishing platform used for Microsoft 365 credential theft. The operation used Microsoft intelligence shared via the FBI, and forensic analysis linked recovered laptops, mobile devices, and other digital equipment to the fraudulent scheme.
Show sources
- Nigeria arrests dev of Microsoft 365 'Raccoon0365' phishing platform — www.bleepingcomputer.com — 19.12.2025 21:05
-
19.12.2025 12:26 1 articles · 5mo ago
RaccoonO365 Microsoft 365 credential-harvesting phishing campaign
Initial DisclosureBetween **January and September 2025**, RaccoonO365 used phishing messages that imitated Microsoft authentication pages to trigger unauthorized **Microsoft 365** access across multiple sectors.
Show sources
- Nigeria Arrests RaccoonO365 Phishing Developer Linked to Microsoft 365 Attacks — thehackernews.com — 19.12.2025 12:26