Microsoft and authorities disrupt AI-enabled cybercrime service RedVDS
Microsoft and international law enforcement disrupted RedVDS, a subscription service that enabled cybercriminals to conduct phishing and payment diversion fraud at scale, often paired with generative AI tools for impersonation. The service caused approximately $40 million in reported US fraud losses and affected hundreds of thousands of accounts and victims across multiple countries. Legal action was taken in the US and UK, and critical infrastructure was seized by German authorities and international law enforcement.
What happened
Microsoft announced on 14 January 2026 that it had disrupted RedVDS, a global subscription-based cybercrime service that charged $24 per month for access to disposable virtual computers running unlicensed software, enabling criminals to operate anonymously across borders.
The service was used primarily for payment diversion fraud, where attackers intercept legitimate business communications and redirect funds by impersonating trusted parties. Between September 2025 and January 2026, RedVDS-linked attacks targeted hundreds of thousands of Microsoft accounts and victims across Europe, North America and beyond.
Microsoft coordinated legal action in the United States and United Kingdom, and German law enforcement seized a critical server. The operation also involved Europol and other international law enforcement agencies, which took the RedVDS marketplace offline.
Reported impact
RedVDS was linked to approximately $40 million in reported US fraud losses since March 2025, with the actual figure believed to be higher due to unreported incidents. European victims included schools and businesses in the United Kingdom, France, Germany, Italy and Spain.
Two victims joined Microsoft as co-plaintiffs: H2-Pharma, an Alabama pharmaceutical company that lost more than $7.3 million including funds earmarked for cancer treatments and children's medicines, and a Florida condominium association defrauded of nearly $500,000 in resident funds.
Index analysis
Generative AI tools were often paired with RedVDS services to help identify targets and generate authentic-appearing messages. Microsoft reported finding hundreds of cases in which scammers used AI tools for face-swapping, voice cloning or video manipulation to trick victims.
Governance controls
Microsoft's Digital Crimes Unit took coordinated civil action in the United States and United Kingdom and worked with German law enforcement and Europol to seize infrastructure and disrupt the service.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.