Microsoft Shuts Down RaccoonO365 Phishing Ring, Seizes 338 Websites

Microsoft’s Digital Crimes Unit seized 338 websites tied to RaccoonO365 (Storm-2246), a subscription phishing service that sold Microsoft 365 credential-stealing kits and has been used since July 2024 to steal at least 5,000 credentials across 94 countries; campaigns included tax-themed attacks against ~2,300 organisations and targeted at least 20 US healthcare organisations. The report describes attribution to an alleged operator, cryptocurrency tracing and partner takedowns, and highlights the broad availability of phishing tools that escalate risk to public and organisational security.