Tech
Microsoft scores win against Office 365 credential thieves | Computer Weekly
Investigators from Microsoft’s Digital Crimes Unit (DCU) have disrupted the network behind the dangerous RaccoonO365 infostealer malware that targeted the usernames and credentials of Office 365 users after being granted a court order in the Southern District of New York.
The operation saw a total of 338 websites linked to the popular malware seized and its technical infrastructure disrupted, severing RaccoonO365 users’ access to their victims.
RaccoonO365 – which was tracked in Microsoft’s threat actor matrix as Storm-2246 – was a relatively unsophisticated, subscription-based phishing kit that exploited Microsoft’s own branding to make its fake email, attachments and websites seem realistic enough to trick victims into interacting with them.
Microsoft’s Stephen Masada, DCU assistant general counsel, said the case showed that effective cyber criminals did not need to be particularly sophisticated to have an impact: “Since July 2024, RaccoonO365’s kits have been used to steal at least 5,000 Microsoft credentials from 94 countries.
“While not all stolen information results in compromised networks or fraud due to the variety of security features employed to remediate threats, these numbers underscore the scale of the threat and how social engineering remains a go-to tactic for cyber criminals.
“More broadly, the rapid development, marketing and accessibility of services such as RaccoonO365 indicate that we are entering a troubling new phase of cyber crime where scams and threats are likely to multiply exponentially.”
The DCU operation appears to have come at the right time as in the past 12 months, Microsoft said RaccoonO365 had undergone a rapid technical evolution with regular upgrades to meet rising demand.
Among other things, users were able to input 9,000 target email addresses every day, and could also “benefit” from on-board features that enabled them to circumvent multi-factor authentication (MFA) safeguards and establish persistent access on their victims’ computers.
In the past few months, RaccoonO365’s operators also started advertising an AI service that supposedly enabled users to scale their operations and improve the effectiveness of their attacks.
Leadership identified
At the same time, the DCU has named a Nigerian national, Joshua Ogundipe, as the leader of the enterprise behind RaccoonO365. He was identified following an operational security lapse in which the gang accidentally revealed a secret cryptocurrency wallet, which the DCU said greatly helped with attribution.
It accused Ogundipe and associates of selling their services via Telegram to their customers, estimated to be around 100 to 200 subscriptions based on the group’s membership of 845 (as of 25 August) – although this is likely an underestimate.
According to Cloudflare, which worked with the DCU throughout the takedown, access to the RaccoonO365 phishing kit was sold on a subscription basis, with 30-day plans available for $355 and 90-day plans for $999, payable in various forms of cryptocurrency.
Alongside his associates, Ogundipe, who supposedly has a background in computer programming and is thought to have written the bulk of RaccoonO365, ran a seemingly professional organisation with specialist development, sales and customer support resources.
To obfuscate their activities, the gang registered multiple internet domains with fake names and addresses around the world, although screengrabs of Ogundipe’s LinkedIn profile shared by the DCU suggest he may be located in Benin City in southern Nigeria.
A criminal referral for his arrest has been circulated to international law enforcement. However, whether or not he ever faces justice is unknown, said Masada.
“Legal challenges persist, especially in places where prosecuting cyber criminals is difficult. Today’s patchwork of international laws remains a major obstacle and cyber criminals exploit these gaps,” said Masada.
“Governments must work together to align their cyber crime laws, speed up cross-border prosecutions and close the loopholes that let criminals operate with impunity. The international community should also support nations that are working to strengthen their defences, while holding accountable those that turn a blind eye to cyber crime.
“While we press forward in the courts, organisations and individuals should also continue to bolster their defences. That means enabling strong multi-factor authentication on accounts, using up-to-date anti-phishing and security tools, and educating users to stay vigilant against evolving scams.”
Tech
New York Is the Latest State to Consider a Data Center Pause
Lawmakers in at least five other states—Georgia, Maryland, Oklahoma, Vermont, and Virginia—have also introduced bills this year that would impose various forms of temporary pauses on data center development. While Georgia, Vermont, and Virginia’s efforts are being led by Democrats, Oklahoma and Maryland’s bills were largely sponsored by Republicans. These bills mirror several moratoriums that have already passed locally: At the end of December, at least 14 states had towns or counties that have paused data center permitting and construction, Tech Policy Press reported.
There are some signs that the data center industry is beginning to respond to the backlash. Last month, Microsoft, with a boost from the White House, rolled out a set of commitments to be a “good neighbor” in communities where it builds data centers. In response to questions on how the industry is responding to the slew of state-level legislation, Dan Diorio, the vice president of state policy at the Data Center Coalition, an industry group, tells WIRED in a statement that it “recognizes the importance of continued efforts to better educate and inform the public about the industry, through community engagement and stakeholder education, which includes factual information about the industry’s responsible usage of water and our commitment to paying for the energy we use.”
Some of the states with moratorium bills have relatively few data centers: Vermont has just two, according to Data Center Map. But Georgia and Virginia are two of the national hubs for data center development and have found themselves at the center of much of the resistance, in both public reaction to data centers and legislative pushback. More than 60 data center-related bills have already been proposed in the Virginia legislature this year, according to Data Center Dynamics, an industry news site.
Josh Thomas is a state delegate in Virginia who has been at the forefront of leading the legislative charge to put limits on the expansion of data centers. During his first legislative session, in 2024, the caucus of self-identified data center “reformers” in both the House and Senate was just three politicians. That number grew to eight in 2025, “and now, it’s 12 or 13,” he says, with many more politicians willing to vote on reform bills. His fellow lawmakers, he says, now “understand that we need to negotiate where these things go.”
Last year, a proposal introduced by Thomas which would have required data centers to perform more in-depth environmental, noise, and community impact site assessments passed the legislature, but was vetoed by then-governor Glenn Youngkin. Newly-elected Governor Abigail Spanberger, a Democrat who talked about making data centers “pay their own way” on the campaign trail, seems much more likely to reconsider this year’s version of the bill, which has already passed the House.
“I’m much more optimistic that [Spanberger] will sign,” Thomas says.
Thomas, who was not involved in shaping the moratorium in the Virginia house, thinks that a moratorium on data centers is much more likely to pass in states where the industry has less of a foothold than Virginia. Still, he says, “it’s not a bad idea.”
Tech
More Than 800 Google Workers Urge Company to Cancel Any Contracts With ICE and CBP
More Than 800 employees and contractors working for Google signed a petition this week calling on the company to disclose and cancel any contracts it may have with US immigration authorities. In a statement, the workers said they are “vehemently opposed” to Google’s dealings with the Department of Homeland Security, which includes Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).
“We consider it our leadership’s ethical and policy-bound responsibility to disclose all contracts and collaboration with CBP and ICE, and to divest from these partnerships,” the petition published on Friday states. Google didn’t immediately respond to a request for comment.
US immigration authorities have been under intense public scrutiny this year as the Trump administration ramped up its mass deportation campaign, sparking nationwide protests. In Minneapolis, confrontations between protesters and federal agents culminated in the fatal shooting of two US citizens by immigration officers. Both incidents were captured in widely disseminated videos and became a focal point of the backlash. In the wake of the uproar, the Trump administration and Congress say they are negotiating changes to ICE’s tactics.
Some of the Department of Homeland Security’s most lucrative contracts are for software and tech gear from a variety of different vendors. A small share of workers at some of those suppliers, including Google, Amazon, and Palantir, have raised concerns for years about whether the technology they are developing is being used for surveillance or to carry out violence.
In 2019, nearly 1,500 workers at Google signed a petition demanding that the tech giant suspend its work with Customs and Border Protection until the agency stopped engaging in what they said were human rights abuses. More recently, staff at Google’s AI unit asked executives to explain how they would prevent ICE from raiding their offices. (No answers were immediately provided to the workers.)
Employees at Palantir have also recently raised questions internally about the company’s work with ICE, WIRED reported. And over 1,000 people across the tech industry signed a letter last month urging businesses to dump the agency.
The tech companies have largely either defended their work for the federal government or pushed back on the idea that they are assisting it in concerning ways. Some government contracts run through intermediaries, making it challenging for workers to identify which tools an agency is using and for what purposes.
The new petition inside Google aims to renew pressure on the company to, at the very least, acknowledge recent events and any work it may be doing with immigration authorities. It was organized by No Tech for Apartheid, a group of Google and Amazon workers who oppose what they describe as tech militarism, or the integration of corporate tech platforms, cloud services, and AI into military and surveillance systems.
The petition specifically asks Google’s leadership to publicly call for the US government to make urgent changes to its immigration enforcement tactics and to hold an internal discussion with workers about the principles they consider when deciding to sell technology to state authorities. It also demands Google take additional steps to keep its own workforce safe, noting that immigration agents recently targeted an area near a Meta data center under construction.
Tech
NordProtect Makes ID Theft Protection a Little Easier—if You Trust That It Works
Once I signed up, I had to fill out several online forms. These include information that might personally identify me, like my Social Security number, phone numbers, email addresses, credit/debit cards, and so on. Filling out the information took about 20 minutes. It’s not effortless, but NordProtect’s interface is clean and intuitive. It puts the information you want to see on top, often alongside brief but informative details, with the option to dive deeper. Notifications are rare, too, so you’re not peppered with distracting alerts.
The exception to this was the first time I logged in. I saw dozens of alerts associated with data breaches that occurred over the past two decades. Once those were dismissed, new notifications were uncommon. The interface can seem a bit too simple. I found it easy to forget exactly what the service was doing for me. NordProtect lacks a mobile app. The website works well enough on a smartphone, but a dedicated app would look better.
NordProtect didn’t provide me with any information or take any actions that had an easily quantifiable impact on my privacy. I looked at each of the 48 data breach alerts that appeared and found that none of them contained worrying information. Much of it was out of date (old passwords, ancient addresses, and so on). Some of it was just straight-up wrong.
NordProtect can offer financial safeguards, but I already have a freeze on my credit, and my bank provides free credit monitoring services. I already use a VPN, so NordVPN wasn’t new to me. The most tangible services I gained were identity theft insurance and access to Incogni. On the other hand, I gained less because I’m already somewhat active in monitoring my personal data. NordProtect would be more valuable if I were starting from scratch.
Doing the Math
NordProtect via Matthew Smith
NordProtect offers monthly, annual, and two-year plans, but the pricing pushes you hard toward yearly subscriptions. Silver is $16, Gold is $24, and Platinum is $32 if you pay monthly. That’s pricey! However, the yearly plans are $84, $114, and $144 for the same tiers, respectively, and the two-year plans are $120/$180/$240.
-
Business1 week agoPSX witnesses 6,000-point on Middle East tensions | The Express Tribune
-
Tech4 days agoHow to Watch the 2026 Winter Olympics
-
Business4 days agoPost-Budget Session: Bulls Push Sensex Up By Over 900 Points, Nifty Reclaims 25,000
-
Tech7 days agoRight-Wing Gun Enthusiasts and Extremists Are Working Overtime to Justify Alex Pretti’s Killing
-
Business7 days agoLabubu to open seven UK shops, after PM’s China visit
-
Tech5 days agoI Tested 10 Popular Date-Night Boxes With My Hinge Dates
-
Fashion1 week agoItaly’s Brunello Cucinelli debuts Callimacus AI e-commerce experience
-
Fashion1 week agoUS Upland cotton exports down 51%, Pima rises: USDA
