Cybercrime: Police Arrest Suspects Behind Microsoft 365 Phishing Attacks in Nigeria

The Nigeria Police Force, through its National Cybercrime Centre (NPF-NCCC), has arrested high-profile internet fraud suspects linked to a coordinated cyberattack targeting Microsoft 365 email systems of major corporate organisations in Nigeria and abroad.

The arrests followed actionable intelligence received from Microsoft Corporation (USA) through the Federal Bureau of Investigation (FBI), which uncovered the deployment of a sophisticated phishing toolkit known as RaccoonO365.

The development was confirmed in a statement signed by CSP Benjamin Hundeyin, Force Public Relations Officer, Force Headquarters, Abuja, on December 18, 2025.

According to police findings, the phishing toolkit was designed to generate fake Microsoft login portals that closely mimicked legitimate authentication pages. Unsuspecting users were tricked into entering their credentials, giving attackers unauthorised access to Microsoft 365 email accounts.

Investigations revealed that between January and September 2025, several corporate, financial, and educational institutions were compromised through phishing emails, leading to business email compromise, data breaches, and financial losses across multiple jurisdictions.

Following the intelligence report, the NPF-NCCC launched a coordinated operation in collaboration with Microsoft, the FBI, and the United States Secret Service. Operatives were deployed to Lagos and Edo States, where three suspects were arrested.

Searches conducted at the suspects’ residences led to the recovery of laptops, mobile phones, and other digital devices. Forensic analysis linked the recovered equipment to the phishing operations.

Further investigations identified Okitipi Samuel, also known as “RaccoonO365” and “Moses Felix,” as the principal suspect and developer of the phishing infrastructure.

Police disclosed that Samuel allegedly operated a Telegram channel where phishing links were sold in exchange for cryptocurrency. The fraudulent Microsoft login portals were reportedly hosted on Cloudflare, using stolen or fraudulently obtained email credentials.

The NPF-NCCC clarified that investigations found no evidence linking the two other arrested individuals to the development or operation of the phishing toolkit.

The Nigeria Police Force reiterated its commitment to protecting Nigeria’s digital ecosystem through advanced technology, strengthened international partnerships, and diligent investigation and prosecution of cyber-related offences.

The Force assured the public that efforts will continue to counter evolving cyber threats and safeguard individuals, businesses, and institutions from online criminal activities.