The Reveal Platform
Intel Name: Cloudflare participates in global operation to disrupt raccoono365
Date of Scan: September 17, 2025
Impact: High
Summary: In early September 2025, Cloudflare partnered with Microsoft to dismantle the RaccoonO365 phishing-as-a-service (PhaaS) operation. The campaign targeted Microsoft 365 users using sophisticated phishing kits with CAPTCHA and anti-bot measures. Cloudflare took down hundreds of malicious domains and Worker accounts on its network, supporting Microsoft’s broader legal action filed in August to disrupt the operation.
