The U.S. authorities alongside the police in Nigeria have arrested top three key players in the manufacturing and selling of RaccoonO365 phishing kits to facilitate nefarious activties of fraudsters and cybercriminals globally.

Phishing kits are pre-packaged collections of software tools, code, and website templates that allow cybercriminals to rapidly deploy highly coordinated email scams, identity theft and other cybercrimes.

In a report on crackdown on cybercrime network across Africa and China published on Wednesday, the U.S. Department of Justice highlighted the role of the Nigerian police in the arrest of  the three Nigerian phishing kit dealers aiding global cybercrimes.

The DoJ said based investigative referral from Microsoft’s Crimes Unit, “the U.S. Attorney’s Office for the District of Columbia, along with the U.S. Secret Service and the Nigeria Police Force – National Cyber Crime Center (NCCC), arrested three key players alleged to be responsible for a global cybercrime conspiracy to manufacture and sell illegal phishing kits.”

It added, “The phishing kit, named RaccoonO365, provided criminals with a means to mimic official Microsoft communications and branding to steal credentials from users of Microsoft’s infrastructure (i.e. Outlook.com).”

The RaccoonO365 phishing kit manufacture and sold by Nigerian fraudsters, the DoJ said, gave “criminals a pathway to gain access to American citizens’ inboxes, the kits enabled a range of illicit activity, including business email compromise, social engineering fraud, and other cybercrime.” 

The DoJ added that the RaccoonO365 

 phishing kits manufactured and folded by the Nigerian fraudsters facilitated business email compromise, ransomware, and financial fraud targeting hospitals within the American health care industry, and victims around the world resulting in the theft of at least 5,000 credentials from 94 countries, and the disruption of critical surgical care. 

Though the DoJ did not mention the names of the three manufacturers and sellers of the phishing kits, another report by Microsoft’s Digital Crimes Unit seen by the Peoples Gazette identified two of them as: Okitipi Samuel, the ringleader behind RaccoonO365, and Joshua Ogundipe. 

Microsoft’s Digital Crimes Unit described RaccoonO365 as an underground “phishing-as-a-service” business, part of the burgeoning cybercrime-as-a-service (CaaS) economy in which cybercriminals sell or rent tools and services that enable people to launch sophisticated cyberattacks such as ransomware without technical skills or expertise. 

It added, “RaccoonO365 sold subscription-based phishing kits that included fraudulent email copy, Microsoft-branded web templates to trick users into providing their credentials, and a tool that enabled subscribers to input up to 9,000 email addresses per day, far more than a legitimate email server would allow.”

RaccoonO365 was sold on the chat platform, Telegram, where its group had over 850 members. The service racked up at least $100,000 in cryptocurrency payments, reflecting an estimated 100–200 subscriptions. Over the course of a year, hundreds of millions of phishing emails went out through RaccoonO365’s service.