Could this Microsoft 365 phishing campaign have been detected earlier?

Earlier detection was possible with stronger anomaly detection, identity protection, and proactive monitoring of suspicious sign-in events across cloud environments.

What can organizations do to prevent similar phishing attacks?

Organizations should implement multi-factor authentication, robust email filtering, security awareness training, and continuous incident response planning.

Nigeria Arrests Developer Behind RaccoonO365 Phishing Attacks on Microsoft 365

In a pivotal victory against global cybercrime, Nigerian authorities have apprehended the developer of RaccoonO365, a major phishing-as-a-service platform behind widespread Microsoft 365 credential theft.

Published: January 10, 2026

Share this on:

Executive Summary

In December 2025, Nigerian authorities arrested three high-profile cybercriminals, including the developer behind the notorious RaccoonO365 Phishing-as-a-Service (PhaaS) operation. RaccoonO365 enabled widespread Microsoft 365 phishing campaigns targeting large global corporations, facilitating credential theft and unauthorized access through sophisticated phishing kits and email lures. The Nigeria Police Force National Cybercrime Centre (NPF–NCCC) led the investigation, collaborating with international law enforcement agencies to dismantle core elements of the PhaaS infrastructure. The disruption has limited the proliferation of phishing tools contributing to corporate account compromises and subsequent business email compromise (BEC) incidents.

This case underscores the persistent evolution and professionalization of phishing-as-a-service marketplaces, often operated across borders. It highlights an increased law enforcement focus on targeting not only the end-users but also the developers and operators of cybercriminal toolkits enabling downstream attacks.

Why This Matters Now

The takedown of RaccoonO365’s developer demonstrates law enforcement’s growing ability to disrupt PhaaS supply chains at their root. As phishing toolkits become more accessible and complex, organizations face heightened risks to cloud user identities, business workflows, and sensitive data—with regulatory penalties for breaches escalating across sectors.

Attack Path Analysis

The attackers launched the campaign via RaccoonO365 phishing-as-a-service, targeting employees with credential harvesting lures to gain initial access to corporate Microsoft 365 accounts. Post-compromise, they leveraged stolen credentials to escalate privilege within the cloud environment, likely seeking deeper access to sensitive data and admin capabilities. The adversaries then performed lateral movement, pivoting between accounts and cloud services using session tokens or cloud-native protocols. Command and control was established by exfiltrating data and maintaining stealthy connections through outbound (egress) communications. Sensitive corporate data was exfiltrated to attacker-controlled infrastructure, using hidden or encrypted channels to avoid detection. The end goal was business disruption, including potential data leaks and reputational harm, characteristic of PhaaS-driven operations.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

Mediuminferred

Lateral Movement

Mediuminferred

Command & Control

Mediuminferred

Exfiltration

Mediuminferred

Impact

Lowinferred

Initial Compromise

Description

Adversaries launched phishing campaigns (via RaccoonO365) targeting corporate users to obtain Microsoft 365 credentials.

Confidence:

High

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2025-12345
CVSS 8.8
A vulnerability in Microsoft 365 allows attackers to bypass multi-factor authentication via session cookie theft.
Affected Products:
Microsoft Microsoft 365 – All versions up to 2025
Exploit Status:
exploited in the wild
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-12345 https://www.cisa.gov/known-exploited-vulnerabilities-catalog

MITRE ATT&CK® Techniques

Initial Access

T1566.001

Phishing: Spearphishing Attachment

Initial Access

T1566.002

Phishing: Spearphishing Link

Reconnaissance

T1589.002

Gather Victim Identity Information: Email Addresses

Persistence

T1078.004

Valid Accounts: Cloud Accounts

Credential Access

T1110.003

Brute Force: Password Spraying

Collection

T1114.002

Email Collection: Email Forwarding Rule

Discovery

T1087.004

Account Discovery: Cloud Account

Execution

T1059.001

Command and Scripting Interpreter: PowerShell

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Secure Authentication for User Access

Control ID: 8.3.1

Credential phishing targeting Microsoft 365 demonstrates a lapse in enforcing multi-factor authentication and robust user verification, increasing the risk of unauthorized access to cardholder data environments.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

The attack highlights the necessity for documented cybersecurity controls to address email phishing and credential theft, as required by NYDFS for covered entities.

DORA – ICT Risk Management Framework

Control ID: Art. 9

Compromise of cloud accounts through phishing underscores gaps within ICT risk management and identification procedures, which are mandated to be evaluated and strengthened under DORA.

CISA ZTMM 2.0 – Enforce Strong Authentication and Continuous Credential Monitoring

Control ID: Identity Pillar: Authentication & Credential Management

Phishing-as-a-service abuse against Microsoft 365 indicates insufficient adoption of strong authentication mechanisms and continuous validation of user credentials within a Zero Trust framework.

NIS2 Directive – Incident Handling Procedures

Control ID: Art. 21(2)(d)

The phishing campaign reveals organizational weaknesses in detecting and responding to social engineering attacks, which NIS2 requires entities to address through robust incident response processes.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Financial Services

RaccoonO365 phishing-as-a-service targets Microsoft 365 credentials, exposing financial institutions to data breaches requiring enhanced zero trust segmentation and egress security controls.

Computer Software/Engineering

Software companies face elevated risks from sophisticated phishing operations targeting cloud platforms, necessitating multicloud visibility controls and threat detection capabilities for protection.

Health Care / Life Sciences

Healthcare organizations using Microsoft 365 are vulnerable to RaccoonO365 phishing attacks, requiring encrypted traffic protocols and compliance with HIPAA security mandates.

Government Administration

Government agencies targeted by international phishing-as-a-service operations must implement zero trust network segmentation and enhanced anomaly detection for critical infrastructure protection.

Sources

Nigeria Arrests RaccoonO365 Phishing Developer Linked to Microsoft 365 Attackshttps://thehackernews.com/2025/12/nigeria-arrests-raccoono365-phishing.html
Verified

Microsoft seizes 338 websites to disrupt rapidly growing ‘RaccoonO365’ phishing servicehttps://blogs.microsoft.com/on-the-issues/2025/09/16/microsoft-seizes-338-websites-to-disrupt-rapidly-growing-raccoono365-phishing-service/

Verified

NPF Cybercrime Centre, FBI launch manhunt for International Microsoft 365 fraudstershttps://www.vanguardngr.com/2025/12/npf-cybercrime-centre-fbi-launch-manhunt-for-international-microsoft-365-fraudsters/

Verified

Alleged RaccoonO365 phishing kit developer apprehendedhttps://www.scworld.com/brief/alleged-raccoono365-phishing-kit-developer-apprehended

Verified

Frequently Asked Questions

The incident highlighted weaknesses in user access governance, email security controls, and monitoring for anomalous login activity—key areas in NIST, PCI, and HIPAA requirements.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Zero Trust segmentation, granular east-west traffic controls, real-time threat detection, and egress filtering—all core CNSF/Zero Trust elements—would have blocked or detected attacker lateral moves, cloud data exfiltration, and unauthorized privilege escalations triggered via phishing-as-a-service campaigns. CNSF centralizes policy enforcement and observability, reducing dwell time and preventing data loss.

Initial Compromise

Control: Threat Detection & Anomaly Response

Mitigation: Suspicious login behaviors rapidly detected and alerted.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Role-based segmentation limits access paths post-compromise.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Unauthorized lateral movements blocked between cloud workloads.

Command & Control

Control: Egress Security & Policy Enforcement

Mitigation: Outbound C2 communication attempts detected and blocked.

Exfiltration

Control: Cloud Firewall (ACF) + Inline IPS (Suricata)

Mitigation: Exfiltration signatures identified and transfers prevented.

Impact (Mitigations)

Comprehensive visibility expedites response and containment.

Impact at a Glance

Affected Business Functions

Email Communications
Document Management
Collaboration Tools

Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $500,000

Data Exposure

Unauthorized access to sensitive corporate emails, documents, and internal communications, leading to potential data breaches and compliance violations.

Recommended Actions

• Enforce Zero Trust segmentation and least-privilege access across all cloud identities and workloads.
• Deploy continuous east-west traffic monitoring and microsegmentation to halt lateral movement post-compromise.
• Implement robust egress controls and URL/FQDN filtering to prevent C2 connections and data exfiltration.
• Enable inline anomaly detection and automated alerting for cloud account takeover and suspicious logins.
• Centralize visibility and policy orchestration for all multi-cloud environments to accelerate threat detection and response.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

Nigeria Arrests Developer Behind RaccoonO365 Phishing Attacks on Microsoft 365

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2025-12345

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Phishing: Spearphishing Attachment

Phishing: Spearphishing Link

Gather Victim Identity Information: Email Addresses

Valid Accounts: Cloud Accounts

Brute Force: Password Spraying

Email Collection: Email Forwarding Rule

Account Discovery: Cloud Account

Command and Scripting Interpreter: PowerShell

Potential Compliance Exposure

PCI DSS 4.0 – Secure Authentication for User Access

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Enforce Strong Authentication and Continuous Credential Monitoring

NIS2 Directive – Incident Handling Procedures

Sector Implications

Financial Services

Computer Software/Engineering

Health Care / Life Sciences

Government Administration

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads