Microsoft and Google Dismantle Major Cybercrime Marketplace RedVDS

Microsoft and Google have joined forces to dismantle RedVDS, a major cybercrime marketplace that operated as an online hub for selling access to virtual machines (VMs) used in phishing and business email compromise scams. The operation was facilitated by the Global Signal Exchange (GSE), which enabled threat data sharing between the two tech giants.

Microsoft's Digital Crimes Unit had been monitoring RedVDS, securing court orders in January 2026 to seize its web domains in the UK and US. Google used this shared threat data to identify and suspend related accounts on its platforms.

Servers associated with RedVDS were impounded in Germany, with Europol taking action against European servers. The service, available for as little as $24 per month, provided VMs that targeted approximately 130,000 organizations between September and December 2025, leading to the compromise of 191,000 Microsoft email accounts.