A Nigerian cybercrime investigation has become part of a wider international effort to dismantle one of the phishing operations used to target Microsoft 365 users around the world.
The Nigeria Police Force’s National Cybercrime Centre worked with Microsoft, the FBI and the US Secret Service to identify suspects linked to RaccoonO365, a phishing-as-a-service operation designed to steal Microsoft 365 login credentials. The arrests were reported in December 2025, following months of investigation.
The Attack Was Bigger Than Nigeria
The scale of the operation explains why international agencies became involved. Microsoft says RaccoonO365 had been used to steal at least 5,000 Microsoft credentials across 94 countries since July 2024. The service provided ready-made phishing pages, emails and other tools that allowed criminals to impersonate Microsoft and trick users into handing over their login details.
That meant the people behind the operation did not necessarily need to attack companies themselves. They could sell the tools to other criminals and allow those customers to carry out the attacks.
Nigeria’s Role Became Critical
The investigation reportedly led Nigerian authorities to Okitipi Samuel, who police identified as a principal suspect and developer linked to the phishing infrastructure. Other suspects were also arrested during operations in Lagos and Edo states, although police said the two other people arrested were not linked to creating or operating the phishing service.
Digital evidence and cryptocurrency tracing were important to the investigation. Microsoft said its investigators followed cryptocurrency payments connected to the operation into Nigeria, helping connect the online infrastructure to people operating in the country.
Why the Case Matters for Nigeria
The Microsoft 365 cyberattack in Nigeria is significant because it shows how cybercrime investigations are increasingly crossing borders.
The criminals, victims, servers, cryptocurrency wallets and investigators can all be in different countries. That makes traditional policing difficult and gives international cooperation a much bigger role.
Microsoft had already secured a US court order in September 2025 to seize 338 websites associated with RaccoonO365. The company said the operation had received at least $100,000 in cryptocurrency payments and had more than 850 members in its Telegram community.
The Bigger Cybercrime Threat
The case also highlights the growing cybercrime-as-a-service economy. Instead of every criminal needing advanced technical skills, services such as RaccoonO365 package the tools and infrastructure needed for phishing and credential theft. Microsoft describes this as a broader shift that is making sophisticated cyberattacks cheaper and easier to launch.
For Nigerian authorities, the case could strengthen the country’s role in international cybercrime investigations. For businesses, it is another reminder that a convincing Microsoft email or login page can be enough to expose an entire organisation when employees are not properly protected.
The operation may have disrupted RaccoonO365, but the wider market for phishing tools remains active. The next challenge for law enforcement will be stopping criminals from simply moving to another service.
