The Nigeria Police have arrested a Nigerian linked to a global Microsoft 365 phishing attack following investigations with the FBI and US Secret Service

The Nigeria Police Force has arrested a Nigerian, Okitipi Samuel, in connection with a cyberattack targeting Microsoft 365 users across several countries.

Also read: NAFDAC destroys ₦10.19bn fake products in Kano

The Force Public Relations Officer, Benjamin Hundeyin, disclosed this on Thursday in Abuja while briefing journalists on investigations conducted by the National Cybercrime Centre (NCCC) of the Nigeria Police Force.

Hundeyin said the case followed a data breach involving Microsoft, in which cybercriminals gained unauthorised access to confidential customer information.

According to him, Microsoft, in collaboration with the Federal Bureau of Investigation (FBI) and the United States Secret Service, launched an investigation that traced the activities of the suspects to Nigeria.

He said the NCCC, under its Director, Commissioner of Police Ifeanyi Abuche, worked jointly with Microsoft, the FBI, the US Secret Service, and the United Kingdom’s National Crime Agency.

“This investigation commenced following credible intelligence received from Microsoft Office USA through the FBI, indicating that a malicious phishing toolkit known as Raccoon0365 was being used to create fake Microsoft login portals,” Hundeyin said.

He explained that the toolkit was deployed to harvest user credentials and unlawfully access email accounts belonging to corporate organisations, financial institutions, and educational establishments.

Hundeyin added that between January and September 2025, several reports of unauthorised access to Microsoft 365 accounts were linked to phishing emails designed to mimic legitimate Microsoft login pages.

“These attacks enabled business email compromise, internal phishing, data breaches, and other cyber-enabled fraud,” he said.

He noted that digital forensic analysis and cryptocurrency tracing uncovered wallets connected to the illegal operation.

Police operatives were subsequently deployed to Lagos and Edo states, leading to the arrest of three suspects identified as Joshua, James, and Okitipi Samuel between September 20 and October 4, 2025.

Searches conducted at their residences led to the recovery of mobile phones, laptops, and other digital devices linked to the alleged scheme.

Hundeyin identified Okitipi Samuel, also known as “0365” and Moses Felix, as the principal suspect and developer of the phishing infrastructure.

He said investigations revealed that Samuel operated a Telegram channel used to sell phishing links in exchange for cryptocurrency and hosted fake Microsoft login pages using stolen or fraudulently obtained email addresses.

The police spokesperson clarified that Joshua and James were victims of identity theft, noting that their identities were used without consent and that no evidence linked them to the creation or operation of the phishing scheme.

“There was no evidence linking them to the creation or operation of the phishing scheme. They were victims of identity theft,” Hundeyin said.

He disclosed that a prima facie case had been established against Samuel for offences including identity theft, unlawful access to computer systems, creation and distribution of malicious software, unauthorised interference with network data, and aiding and abetting fraud.

The suspect will be charged under relevant provisions of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2024.

Hundeyin added that prosecution would take place in Nigeria, although extradition could be considered if formally requested through appropriate legal channels.

He assured Nigerians that the police, under the leadership of the Inspector-General of Police, Kayode Egbetokun, would continue to safeguard the country’s digital ecosystem.

Also speaking, the Director of the National Cybercrime Centre urged Nigerians to practise good cyber hygiene, warning against clicking on suspicious links or responding to unsolicited emails.

Also read: NAFDAC destroys ₦10.19bn fake products in Kano

He advised citizens to verify online sources before sharing personal or corporate information to prevent unauthorised account access.