Microsoft’s latest cybercrime effort disrupts global fraud service

Today, Microsoft is announcing a coordinated legal action in the United States and, for the first time, the United Kingdom to disrupt RedVDS , a global cybercrime subscription service fueling millions in fraud losses. These efforts are part of a broader joint operation with international law enforcement, including German authorities and Europol , which has allowed Microsoft and its partners to seize key malicious infrastructure and take the RedVDS marketplace offline , a major step toward dismantling the networks behind AI-enabled fraud, such as real estate scams.

US $24 a month, RedVDS provides criminals with access to disposable virtual computers that make fraud cheap, scalable, and difficult to trace. Services like these have quietly become a driving force behind today ' s surge in cyber - enabled crime, powering attacks that harm individuals, businesses, and communities worldwide. Since March 2025, RedVDS - enabled activity has driven roughly US 40 in reported fraud losses in the United States alone. Among the victims is H2-Pharma , an Alabama - based pharmaceutical company that lost more than $7.3 million - money supposed to be used to sustain lifesaving cancer treatments, mental health medications, and children ' s allergy drugs for patients across the country. In a separate case, the in Florida was tricked out of nearly $500,000 - funds contributed by residents and property owners for essential repairs. Both organizations are joining Microsoft as co - plaintiffs in this civil action .

But these cases represent only a fraction of the harm. Fraud and scams frequently go unreported, victims are global, and cybercriminals routinely pivot across platforms and service providers. For the individual, fraud has lasting effects that extend beyond financial loss to emotional wellbeing, health, relationships, and long-term stability. As a result, the true toll of RedVDS-enabled activity is far higher than the roughly US $40 million Microsoft can directly observe.

What RedVDS is-and why it matters

RedVDS is an online subscription service that is part of the growing cybercrime-as-a-service ecosystem where cybercriminals buy and sell services and tools to launch attacks at scale. It provides access to cheap, effective, and disposable virtual computers running unlicensed software, including Windows, allowing criminals to operate quickly, anonymously, and across borders.

Cybercriminals use RedVDS for a wide range of activities, including sending high-volume phishing emails, hosting scam infrastructure, and facilitating fraud schemes. RedVDS is frequently paired with generative AI tools that help identify high-value targets faster and generate more realistic, multimedia message email threads that mimic legitimate correspondences. In hundreds of cases, Microsoft observed attackers further augment their deception by leveraging face-swapping, video manipulation, and voice cloning AI tools to impersonate individuals and deceive victims.

In just one month, more than 2,600 distinct RedVDS virtual machines sent an average of one million phishing messages per day to Microsoft customers alone. While most were blocked or flagged as part of the 600 million cyberattacks Microsoft blocks per day, the sheer volume meant a small percentage may have succeeded in reaching the targets' inboxes. Since September 2025, RedVDS-enabled attacks have led to the compromise or fraudulent access of more than 191,000 organizations worldwide. These figures represent only a subset of the impacted accounts across all technology providers, illustrating how quickly this infrastructure increases the scale of cyberattacks.

How RedVDS enables fraud

One of the most common ways RedVDS-enabled attacks result in financial loss is through payment diversion fraud, also known as business email compromise, or "BEC." In these schemes, attackers gain unauthorized access to email accounts, quietly monitor ongoing conversations, and wait for the right moment, such as an upcoming payment or wire transfer. At that point, they impersonate a trusted party and redirect funds, often moving the money within seconds. Both H2-Pharma and the Gatehouse Dock Condominium Association were targeted through sophisticated BEC schemes that exploited trust and timing.

RedVDS has also been heavily used to facilitate real estate payment diversion scams, one of the fastest-growing forms of cyber-enabled fraud. In these cases, attackers compromise the accounts of realtors, escrow agents, or title companies and send strategically timed emails with fraudulent payment instructions designed to divert closing funds, escrow payments, and other sizeable transactions. For families and first altogether. Microsoft has observed RedVDS-enabled activity affecting more than 9,000 customers in the real estate sector alone, with particularly severe impact in countries such as Canada and Australia.

And the threat goes far beyond real estate. RedVDS-enabled scams have hit construction, manufacturing, healthcare, logistics, education, legal services, and many other sectors-disrupting everything from production lines to patient .

A Global Response to a Global Threat

Cybercrime today is powered by shared infrastructure, which means disrupting individual attackers is not enough. Through this coordinated action, Microsoft has disrupted RedVDS's operations, including seizing two domains that host the RedVDS marketplace and customer portal, while also laying the groundwork to identify the individuals behind them.

Microsoft's legal actions are reinforced by close collaboration with law enforcement partners around the world, further disrupting the malicious operation. Germany's Public Prosecutor's Office Frankfurt am Main - Central Office for Combating Internet Crime (ZIT) and the German State Criminal Police Office Brandenburg. At the same time and as part of this ongoing disruption, Microsoft is also working closely with international law enforcement, including Europol's European Cybercrime Centre (EC3), to disrupt the broader network of servers and payment networks that supported RedVDS customers as part of the ongoing disruption.[Link] What people and organizations can do

We are deeply grateful to H2 - -P harma and the Gatehouse Dock Condominium Association for their willingness to come forward and share their experiences. Their cooperation, combined with Microsoft's threat intelligence victim to a scam should never carry stigma. These attacks are executed by organized, professional criminal groups that intercept and manipulate legitimate communications trusted parties .

Simple steps can significantly reduce risk, including slowing down and questioning urgency, calling points of contact back using numbers that are already known to you, verifying payment requests using additional contact information, enabling multifactor authentication, watching carefully for subtle changes in email addresses, keeping software up to date, and reporting suspicious activity to law enforcement. Every report helps dismantle networks like RedVDS and brings us closer to stopping cybercrime at scale.

Continuing a collective effort to disrupt cybercrime

This action against RedVDS builds on Microsoft's ongoing efforts to disrupt fraud and scam infrastructure through legal and technical action, collaboration with law enforcement, and participation in global initiatives such as the National Cyber-Forensics and Training Alliance (NCFTA) and the Global Anti-Scam Alliance (GASA). It marks the 35th civil action targeting cybercrime infrastructure by Microsoft's Digital Crimes Unit, underscoring a sustained strategy to go beyond individual takedowns and dismantle the services that criminals rely on to operate and scale.

As services like RedVDS continue to emerge, Microsoft will keep working with partners across sectors and borders to identify and disrupt the infrastructure behind cyber-enabled fraud, making it harder for criminals to profit and easier for people and organizations to stay safe online.

Tags: cyberattacks, The Digital Crimes Unit