---
title: Microsoft Takes Down RedVDS Cybercrime Service That Stole Millions
description: Microsoft and global law enforcement shut down RedVDS, a cybercrime hub enabling large-scale phishing and email attacks worldwide.
canonical_url: https://codekeeper.co/ticker/microsoft-shuts-down-redvds-cybercrime-hub
---

# Microsoft Takes Down RedVDS Cybercrime Service That Stole Millions

Microsoft and global law enforcement shut down RedVDS, a cybercrime hub enabling large-scale phishing and email attacks worldwide.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 15, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Microsoft partnered with international law enforcement to shut down RedVDS, a cybercrime marketplace that enabled attackers to steal millions from businesses worldwide. The $24-per-month service provided criminals with disposable virtual computers to launch phishing campaigns and business email compromise attacks. RedVDS facilitated major thefts, including $7.3 million from Alabama pharmaceutical company H-2 Pharma and nearly $500,000 from a Florida condominium association. The service operated at massive scale, with 2,600 virtual machines sending 1 million phishing messages daily to Microsoft customers alone. Since September, attackers compromised over 191,000 organizations globally using RedVDS infrastructure. Microsoft seized two key domains and laid groundwork to identify the operators behind the service. **Source:** [Dark Reading](https://www.darkreading.com/threat-intelligence/microsoft-disrupts-cybercrime-service-redvds)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-shuts-down-redvds-cybercrime-hub%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security One POST Request Can Freeze a Next.js Server Oct 12, 2026](https://codekeeper.co/ticker/react-vulnerability-freezes-nextjs-servers)

[Android Zero-Day Bug Hands Attackers Near-Total Device Control Aug 12, 2026](https://codekeeper.co/ticker/android-zero-day-vulnerability-cve-2025-48595)

[Cyberattacks ‘AgentCorruption’ Could Have Hijacked an AWS Region With One Prompt Oct 9, 2026](https://codekeeper.co/ticker/aws-agentcorruption-vulnerability-patched)

[Cyberattacks TanStack Attack Exposed 170 Private CrowdSec Repositories Sep 21, 2026](https://codekeeper.co/ticker/tanstack-npm-supply-chain-attack)