Nigeria Police Force National Cybercrime Centre (NPF-NCCC) is investigating a major international cybercrime case, others

Nigeria Police Force National Cybercrime Centre (NPF-NCCC) is investigating a major international cybercrime case, others

Press Conference

The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) is investigating a major international cybercrime case, which involves Computer-Related Fraud, Phishing, Identity Theft, Malware Attacks, Impersonation, targeting Microsoft 365 users across multiple countries.

This investigation commenced following credible intelligence received from Microsoft Office U.S.A through the Federal Bureau of Investigation
(FBI), indicating that a malicious phishing toolkit known as Raccoon365 was being used to create fake Microsoft login portals, harvest user credentials, and unlawfully access the email accounts of corporate organizations, financial institutions, and educational establishments.

The NPF-NCCC initiated a coordinated operation with Microsoft, the FBI, and the United States Secret Service. Between January and September 2025, several reports of unauthorized access to Microsoft 365 accounts were traced to phishing emails designed to mimic legitimate Microsoft login pages, enabling business email compromise, internal phishing, data breaches, and other cyber-enabled fraud.

Through extensive digital forensics and technical intelligence analysis, the centre conducted cryptocurrency tracing that identified suspicious wallets connected to cash-out schemes.

Acting on actionable intelligence, operational teams were deployed to Lagos and Edo States, resulting in the arrest of one Joshua, James and one Okitipi Samuel on September 20th, 4th October 2025. Search operations at their residences led to the recovery of mobile devices, laptops, and other digital exhibits linked to the elaborate and fraudulent scheme. The primary suspect, Mr. Okitipi Samuel, also known as “Raccoon0365” and Moses Felix,” has been identified as the developer and operator of this phishing infrastructure.

Further investigations revealed that he managed a Telegram channel used to sell phishing links for cryptocurrency and hosted fake login pages on Cloudflare using stolen or fraudulently obtained email addresses. Investigations also confirm that he unlawfully used the email information of one of the arrested individuals without consent to register some of these accounts.