The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) says it is investigating a major international cybercrime case, which involves Computer-Related Fraud, Phishing, Identity Theft, Malware Attacks, Impersonation, targeting Microsoft 365 users across multiple countries.
According to CSP Benjamin Hundeyin, Force Public Relations Officer, Force Headquarters Abuja in a press briefing, this investigation commenced following credible intelligence received from Microsoft Office U.S.A through the Federal Bureau of Investigation
(FBI), indicating that a malicious phishing toolkit known as Raccoon0365 was being used to create fake Microsoft login portals, harvest user credentials, and unlawfully access the email accounts of corporate organizations, financial institutions, and educational establishments.
The NPF-NCCC initiated a coordinated operation with Microsoft, the FBI, and the United States Secret Service. Between January and September
2025, several reports of unauthorized access to Microsoft 365 accounts were traced to phishing emails designed to mimic legitimate Microsoft login pages, enabling business email compromise, internal phishing, data breaches, and other cyber-enabled fraud.
Through extensive digital forensics and technical intelligence analysis, the center conducted cryptocurrency tracing that identified suspicious wallets
connected to cash-out schemes.
Acting on actionable intelligence, operational teams were deployed to Lagos and Edo States, resulting in the arrest of one Joshua, James and one Okitipi Samuel on September 20th, 4th October 2025. Search operations at their residences led to the recovery of mobile devices, laptops, and other digital exhibits linked to the elaborate and fraudulent scheme.
The primary suspect, Mr. Okitipi Samuel, also known as the Centre "Moses Felix," has been identified as the developer and operator of this Phishing infrastructure. Further investigations revealed that he managed a Telegram channel used to sell phishing links for cryptocurrency and hosted fake login pages on Cloudflare using stolen or fraudulently obtained email addresses. Investigations also confirm that he unlawfully used the email information of one of the arrested individuals without consent to register some of these accounts.
Blockchain analysis further traced cryptocurrency wallets used in the operation to Bitnob and Exodus Wallet, with the linked KYC information identifying Okitipi Samuel as the sole beneficiary. Evidence shows that the phishing links he generated facilitated multiple unauthorized intrusions into Microsoft 365 accounts across several jurisdictions, resulting in business email compromise, financial losses, and the exposure of sensitive information.
Importantly, the investigation found no evidence that Joshua and James participated in the creation or operation of the RaccoonO365 scheme.
Their personal information and devices were instead exploited without their authorization by the principal suspect.
A prima facie case has been established against Okitipi Samuel for Identity Theft, Unlawful Access to Computer Systems, Creation and Distribution of Malicious Software, Aiding and Abetting Fraud, and Unauthorized Interference with Network Data. He is to be charged under the relevant provisions of the Cybercrimes (Prohibition, Prevention, etc.)
Act 2024.
CSP Hundeyin however reiterates the commitment of the Nigerian police force under the leadership of IGP Egbetokun to continue to safe guard lives and properties.
"The Nigeria Police Force under the leadership of IGP Kayode Adeolu Egbetokun reiterates its unwavering commitment to safeguarding Nigerias digital ecosystem and protecting citizens, businesses, and institutions from emerging cyber threats."
0 Comments