The Nigeria Police Force’s National Cybercrime Centre (NPF-NCCC), in a joint operation with the United States Federal Bureau of Investigation (FBI) and the US Secret Service, has arrested three suspected internet fraudsters in Lagos and Edo States.
The arrests followed an intelligence-driven operation targeting a sophisticated phishing and cyber-fraud scheme linked to multiple corporate data breaches. The development was disclosed in a statement issued on Thursday by the Force Public Relations Officer, CSP Benjamin Hundeyin.
According to the police, the suspects allegedly carried out targeted cyber-attacks against the email systems of major corporate organisations, primarily within Nigeria, using phishing links and malicious software.
The statement revealed that credible intelligence from Microsoft Corporation and the FBI exposed the suspects’ use of a specialised phishing toolkit known as RaccoonO365, designed to create fake Microsoft login portals to steal user credentials and gain unauthorised access to Microsoft 365 accounts.
Hundeyin said investigations traced several incidents of unauthorised Microsoft 365 account access between January and September 2025 to phishing emails that closely mimicked legitimate Microsoft authentication pages.
“These activities resulted in business email compromise, data breaches and financial losses across multiple jurisdictions,” he said.
He explained that the NPF-NCCC subsequently launched a coordinated operation in collaboration with Microsoft, the FBI and the US Secret Service, leading to the deployment of operatives to Lagos and Edo States and the arrest of three suspects.
Searches conducted at the suspects’ residences led to the recovery of laptops, mobile phones and other digital devices, which forensic analysis has linked to the fraudulent scheme.
Further investigations identified Okitipi Samuel, also known by the aliases “RaccoonO365” and “Moses Felix,” as the principal suspect and alleged developer of the phishing infrastructure. Police said he operated a Telegram channel through which phishing links were sold in exchange for cryptocurrency and hosted fraudulent login portals on Cloudflare using stolen or fraudulently obtained email credentials.
However, the police noted that investigations so far have found no evidence linking the two other arrested individuals to the creation or operation of the phishing infrastructure.
The Nigeria Police Force reaffirmed its commitment to protecting Nigeria’s digital space through advanced technology, strengthened international cooperation and diligent investigative and prosecutorial processes aimed at combating evolving cyber threats.
