Microsoft Strikes Blow Against ‘RedVDS’ Cybercrime Ring in Global Crackdown

In a major offensive against the shadow economy of cybercrime, Microsoft has launched coordinated legal strikes in the United States and the United Kingdom aimed at dismantling RedVDS. The tech giant is not acting alone; the operation involves a sweeping collaboration with international law enforcement bodies, including Europol and German authorities, to shut down a subscription service responsible for tens of millions of dollars in fraud.

RedVDS operated as a budget-friendly gateway for digital fraud, offering subscription-based access to disposable infrastructure. For a mere $24 per month, criminals could rent virtual machines running unlicensed versions of Windows. This "infrastructure-as-a-service" model effectively lowered the technical barrier for scammers, allowing them to launch high-volume, anonymous attacks that were difficult for authorities to trace across international borders. The platform even incentivized its user base with a loyalty program and referral bonuses, mimicking legitimate software-as-a-service business models.

The human and financial cost of this accessibility has been staggering. Since March 2025, activity facilitated by RedVDS has been linked to approximately $40 million in reported fraud losses within the U.S. alone. Beginning in September 2025, over 191,000 organizations globally found their accounts compromised or fraudulently accessed through the platform’s resources. Security researchers discovered that the platform was frequently utilized to host scam sites and blast out massive waves of phishing emails.

However, the attacks went beyond simple spam. RedVDS was often deployed in tandem with generative AI tools, enabling criminals to create highly convincing multimedia. Attackers utilized voice cloning, video manipulation, and face-swapping technology to impersonate trusted individuals, tricking victims into diverting funds during critical transactions. Steven Masada, Assistant General Counsel for Microsoft’s Digital Crimes Unit, noted that in a single month, over 2,600 unique RedVDS virtual machines churned out an average of one million phishing messages daily just to Microsoft customers, relying on sheer volume to bypass security filters.

The victims were rarely random individuals but rather specific sectors relying on email for high-value payments. Real estate firms were heavily targeted, particularly during property sales and escrow closures. Healthcare providers saw funds stolen that were intended for medical and operational costs, while community groups lost capital reserved for maintenance projects. In most cases, the attackers lurked in email threads, monitoring conversations to inject fraudulent payment instructions exactly when a transfer was expected.