- Microsoft, Europol, and German police dismantle RedVDS cybercrime infrastructure
- RedVDS enabled phishing, BEC, and malware via cheap disposable Windows cloud servers
- Platform caused $40M losses in 2025; criminals used AI for phishing and deepfakes
Microsoft has announced the disruption of a significant cybercriminal platform operating in the US and UK, which has inflicted millions of dollars in damages on various businesses.
In an announcement, Microsoft revealed that it collaborated with Europol and German law enforcement to successfully seize the infrastructure utilized by RedVDS, a low-cost platform that facilitated phishing, business email compromise, malware distribution, and more.
According to Microsoft, "For as little as $24 a month, RedVDS provides criminals with access to disposable virtual computers that make fraud cheap, scalable, and difficult to trace." The company emphasized that services like these have become a driving force behind the rise in cyber-enabled crime, leading to attacks that harm individuals, businesses, and communities globally.
Millions in Damages
Microsoft explained that RedVDS sold access to virtual Windows cloud servers, all derived from a single Windows Server 2022 image, which left a unique fingerprint that researchers could track.
The platform rented servers from hosting providers across the US and Europe, allowing cybercriminals to use IP addresses close to their targets, thus evading location-based security measures.
In addition to Microsoft, several private businesses, including H2-Pharma and the Gatehouse Dock Condominium Association, have joined as co-plaintiffs. H2-Pharma claims to have lost $7.3 million in a Business Email Compromise (BEC) attack, while the Gatehouse Dock Condominium Association reports a loss of nearly $500,000 in residential funds.
In 2025, RedVDS facilitated losses of at least $40 million across the United States alone, with over 9,000 customers scammed in Canada and Australia.
Microsoft also discovered that RedVDS customers employed Generative AI to craft convincing phishing emails, along with advanced tools for face-swapping, video manipulation, and voice cloning.
On average, these criminals sent over a million phishing emails each month to Microsoft customers, compromising approximately 200,000 accounts within just six months.
Via BleepingComputer