Judge Jed Rakoff Closed the RaccoonO365 Civil Case in Default While Nigeria’s File Still Names Okitipi Samuel
A Manhattan judge ended the civil fight over RaccoonO365 without a trial. Nigeria’s police still have a different name on the criminal side of the same kit. Those two facts can sit in the same week and still leave the person who wrote the code untested in a courtroom that can lock a cell.
On May 18, 2026, U.S. District Judge Jed S. Rakoff granted Microsoft Corporation and Health-ISAC a default judgment and a permanent injunction in the Southern District of New York, case 1:25-cv-07111. The defendants were Joshua Ogundipe and John Does 1 through 4. They did not appear. Default is what a civil court does when a sued party skips the fight. It is not a jury saying a named person committed a crime, and it is not a plane ticket to a Nigerian dock. The order restrains the RaccoonO365 defendants, their representatives, and people acting with them from intentionally accessing protected computers without authorization, among other limits written into the injunction. The docket shows the case terminated that day.
Months earlier, the Nigeria Police Force National Cybercrime Centre told reporters it had booked Okitipi Samuel, also called Moses Felix, as the developer of the phishing infrastructure. Spokesman Benjamin Hundeyin said officers worked from intelligence passed by Microsoft through the FBI and the U.S. Secret Service. Raids in Lagos and Edo States produced laptops, phones, and other devices. Two other people taken in those sweeps were later released. Hundeyin said investigators found no evidence those two built or ran the platform, and he described them as victims of identity theft. Punch reported the three names on the original arrest list as Joshua, James, and Okitipi Samuel, with the pickups placed between September 20 and October 4, 2025, and the public briefing coming in December. Public reporting has not established that the released man called Joshua is the Joshua Ogundipe Microsoft sued in New York. Treating those names as one person would invent a fact the police statement and Microsoft’s complaint do not share.
A storefront that rented the Microsoft logo
RaccoonO365 was sold like a subscription, not like a one-off exploit. Buyers paid about $355 for 30 days or $999 for 90 days, in cryptocurrency only. The kit generated sign-in pages that copied Microsoft, DocuSign, SharePoint, Adobe, and Maersk. The lures leaned on invoices, payroll, and human-resources themes, the messages a tired employee is trained to open. Telegram channels tied to the shop counted more than 850 members. Recorded crypto payments topped $100,000. A sender could push the same lure toward as many as 9,000 targets in a day.
Researchers who tracked the service from at least July 2024 say it harvested more than 5,000 Microsoft 365 credentials across 94 countries. The mechanic was an adversary-in-the-middle proxy. The fake page talked to Microsoft’s real login servers, so a victim who typed a password and approved a prompt handed over the password, the one-time code, and a live session cookie in the same motion. Cloudflare Turnstile challenges made the pages look like ordinary corporate gates. Cloudflare later said the paying customer base was mainly crews based in Russia. By late 2025 the operators were selling an add-on called RaccoonO365 AI-MailCheck, a filter meant to score which stolen mailboxes were worth keeping. Microsoft tracks the activity as Storm-2246. The September 2025 disruption, described inside the Digital Crimes Unit as Operation Trashpanda, is the subject of a SANS CTI Summit briefing by investigators Maurice Mason and Nick Monaco.
Three hundred thirty-eight domains, then a default
The police work followed a technical seizure. Microsoft’s Digital Crimes Unit, Cloudflare’s Cloudforce One, and Chainalysis used a Southern District of New York order to seize 338 domains in September 2025. Microsoft and Health-ISAC sued under the Computer Fraud and Abuse Act, the Racketeer Influenced and Corrupt Organizations Act, and the Electronic Communications Privacy Act. Microsoft told the court the operation had cost it more than $650,000. Investigators said a sloppy cryptocurrency wallet helped put a name on the crew. Seized sites were replaced with warning pages. Paying customers moved to new hosts, which is what a phishing-as-a-service shop does when a brand gets burned. The May 2026 default judgment is the civil ending of that same lawsuit, not a second, separate story. The Record and BleepingComputer laid out the Nigerian arrests when they were new. The Hacker News reported Samuel was accused of running the Telegram sales channel and hosting fake portals on Cloudflare with stolen or fraudulently obtained email accounts.
A captured Outlook session is not a trophy login. It is a seat inside payroll, vendor invoices, patient charts, and student records. Microsoft documented an April 2025 tax-themed blast that hit more than 2,300 U.S. organizations, including at least 20 hospitals and healthcare providers. From a live mailbox the next steps are familiar: watch the threads, send internal phishing that looks like a coworker, then open the door for ransomware. The same vendor-risk pattern shows up in The AEGIS Alliance reporting on the 700Credit breach that exposed nearly 6 million car buyers and the Mixpanel incident that put Pornhub Premium analytics in play.
Abuja’s statute and a docket that does not share a defendant list
Commissioner of Police Ifeanyi Uche, who heads the National Cybercrime Centre, told users not to treat unexpected login prompts as routine. Hundeyin said campaigns of this kind produced business email compromise, data theft, and losses across several countries. The kit did not need a zero-day. It needed one person willing to type a password into a page that looked like Microsoft.
Samuel faces allegations of identity theft, unlawful access, creation and distribution of malicious software, and related counts under Nigeria’s Cybercrimes Act of 2024. Early reporting put a preliminary court date around February 3, 2026. Nigerian authorities were also described as having frozen accounts worth about 250 million naira, on the order of $550,000, while mapping money mules. As of late September 2026, public reporting still does not show a completed criminal conviction of Samuel or a completed U.S. extradition of Ogundipe. The FBI’s interest in the alleged mastermind under the Computer Fraud and Abuse Act is a referral, not a rendered sentence. Judge Rakoff’s injunction can bind people who show up in a U.S. case. It cannot, by itself, put a defendant in a cell in Lagos.
That gap is why the names matter. Microsoft’s complaint says Ogundipe, a programmer it placed in Nigeria, likely wrote most of the code and worked with associates on development, sales, and support. Nigeria’s December briefing named Samuel as the principal developer and did not name Ogundipe. A civil default against a person who never answered the complaint does not resolve which of those descriptions a future criminal court will accept. Readers who want the cross-border pattern can look at The AEGIS Alliance file on how U.S. Treasury workstations were remotely accessed, and at the later account of how Google dismantled a shadow network that used phones as quiet infrastructure.
What actually breaks this product
Password-plus-text-message multi-factor authentication is the control RaccoonO365 was built to steal. A proxy that sits between the user and the real login page can relay both the password and the one-time code, then ride the resulting cookie. Passkeys and hardware security keys are harder to replay that way because the proof is bound to the real site, not to a lookalike. Checking the address bar before a password goes in, and reporting the message to the person who runs the tenant instead of clicking “verify your account,” is dull. It is also the reason a $355 Telegram subscription stops printing money.
A phishing-as-a-service shop that sells to clients on several continents will not be closed by one country’s press conference. Domain seizures raise the cost. They do not erase the customer list. The open question, after the default judgment and after Samuel’s booking, is whether the next kit keeps the raccoon sticker or just changes the brand on the same proxy. Until a criminal court tests the evidence against a specific person, the disruption is a pause. Related coverage lives on The AEGIS Alliance hacker news, technology, and international news desks. The kit was cheap. The mailbox it opened was not.
