Microsoft 365 Cyberattack Foiled: Nigeria Police Arrest ‘RaccoonO365’ Phishing Kingpin, Partners FBI, Microsoft

Follow

( 0 Followers )

X

Follow

E-mail : *

Follow Unfollow

The Nigeria Police Force (NPF), through its National Cybercrime Centre (NPF–NCCC), has recorded a major breakthrough in the fight against cybercrime with the arrest of suspects linked to sophisticated cyberattacks on Microsoft 365 email systems used by major corporate organisations.

A statement on Thursday December 18, 2025, signed by Benjamin Hundeyin, chief superintendent of police, (CSP) and Force Public Relations Officer,
Force Headquarters, Abuja, said the operation followed high-level, actionable intelligence provided by Microsoft Corporation in the United States, transmitted through the Federal Bureau of Investigation (FBI).

Hundeyin said the intelligence uncovered the deployment of an advanced phishing toolkit known as RaccoonO365, which was used to create fake Microsoft login pages designed to steal user credentials and gain unauthorised access to corporate email accounts.

According to the PPRO, police “investigations revealed that the cybercriminals targeted corporate, financial, and educational institutions, resulting in widespread business email compromise, data breaches, and substantial financial losses across multiple jurisdictions.

“In response, the NPF–NCCC launched a coordinated, intelligence-led operation in collaboration with Microsoft, the FBI, and the United States Secret Service. Findings showed that between January and September 2025, several Microsoft 365 accounts were illegally accessed through phishing emails carefully crafted to mimic legitimate Microsoft authentication portals”.

He said based on precise intelligence, cybercrime operatives were deployed to Lagos and Edo States, leading to the arrest of three suspects, adding that “subsequent searches of their residences resulted in the recovery of laptops, mobile phones, and other digital devices”.

He said forensic examinations have since linked the recovered items to the cyber fraud scheme.

Further investigations identified Okitipi Samuel, also known by the aliases “RaccoonO365” and “Moses Felix,” as the mastermind and developer of the phishing infrastructure. Police said he allegedly operated a Telegram channel where phishing links were sold in exchange for cryptocurrency and hosted fake Microsoft login portals on Cloudflare using stolen or fraudulently acquired email credentials.

The police clarified that while three suspects were arrested, investigations found no evidence linking the two other individuals to the development or management of the phishing toolkit.

Reiterating its commitment to securing Nigeria’s digital space, the Nigeria Police Force said it would continue to leverage cutting-edge technology, deepen international partnerships, and strengthen investigative and prosecutorial processes to effectively counter emerging cyber threats.

The Force also urged individuals and organisations to remain vigilant, avoid clicking suspicious links, and adopt strong cybersecurity practices to protect sensitive information.