Microsoft disrupts RedVDS, a fraud service that hit Canadian e-mail accounts hard
Microsoft said Jan. 14 that it had disrupted RedVDS, a subscription service that rented criminals disposable virtual computers for phishing and payment fraud, and that Canada was one of the five countries most affected by e-mail account compromises linked to it.
The service matters to small and medium businesses because it was built for the kind of fraud that hits them most: taking over an e-mail account, watching for a payment and redirecting it. Microsoft said RedVDS-enabled real estate fraud had a particularly severe impact in Canada and Australia.
What RedVDS did
According to Microsoft's announcement, RedVDS sold access to virtual machines running unlicensed Windows software for about US$24 a month. Customers used them to send high-volume phishing, host scam infrastructure and run fraud. Microsoft said attackers often paired the service with generative AI tools to identify targets and write convincing e-mail threads, and in hundreds of cases used face-swapping, video manipulation or voice cloning.
In one month, more than 2,600 RedVDS machines sent about one million phishing messages a day to Microsoft customers. Since September 2025, Microsoft said, RedVDS-enabled attacks had led to the compromise or fraudulent access of more than 191,000 organizations worldwide, including more than 9,000 real estate customers. It linked about US$40 million in reported U.S. fraud losses to the service since March 2025 and said that is only part of the true total.
The typical scheme, Microsoft said, was to get into an e-mail account, monitor conversations, wait for a wire transfer or closing payment, then impersonate a trusted party and supply new payment instructions. Realtors, escrow agents and title firms were frequent targets, along with construction, manufacturing, health care, logistics and legal services.
The takedown
Microsoft took legal action in the United States and, for the first time, the United Kingdom, and seized two domains hosting the marketplace and customer portal. German prosecutors in Frankfurt (ZIT) and Brandenburg state police seized a key server, taking the marketplace offline, while Europol's European Cybercrime Centre is working on the wider server and payment network. Two U.S. victims, a pharmaceutical company that lost more than US$7.3 million and a Florida condominium association that lost nearly US$500,000, joined Microsoft as co-plaintiffs.
Takedowns of this kind rarely end the activity for good. The Canadian Anti-Fraud Centre reported more than $68 million in spear phishing losses in 2025, and its mid-year figures show about $57.7 million more in the first half of 2026.
What to do
- Call back to confirm any payment or banking change, using a number you already have rather than one in the message.
- Look closely for small changes in sender addresses.
- Turn on multi-factor authentication and keep software updated.
- Real estate and legal firms should warn clients at the start of every deal that wire instructions will never change by e-mail.
- Report fraud to police and the Canadian Anti-Fraud Centre.
