Microsoft’s Digital Crimes Unit (DCU) has disrupted RaccoonO365, the fastest-growing tool used by cybercriminals to steal Microsoft 365 usernames and passwords (“credentials”). Using a court order granted by the Southern District of New York, the DCU seized 338 websites associated with the popular service, disrupting the operation’stechnical infrastructureandcutting off criminals’ access to victims. This case shows that cybercriminals don’t need to be sophisticated to cause widespread harm—simple tools like RaccoonO365 make cybercrime accessible to virtually anyone, putting millions of users at risk.
While RaccoonO365 services are used to target all industries, as evidenced by anextensive tax-themed phishing campaign targeting over 2,300 organizations in the United States, most alarmingly, its kits have been used against at least 20 U.S. healthcare organizations. This puts public safety at risk, asRaccoonO365 phishing emails are often a precursor to malware and ransomware, which have severe consequences for hospitals. In these attacks,patient services are delayed, critical care is postponed or canceled, lab results are compromised, and sensitive data is breached, causing major financial losses and directly impacting patients. These severe consequences are a key reason why the DCUis filing this lawsuit in partnership with Health-ISAC—a global non-profit focused on cybersecurity and threat intelligence for the health sector.
