RedVDS disrupted: cloned Windows fueled global phishing

On 14 January 2026, Microsoft described coordinated legal and technical action against RedVDS, a service the company linked to phishing, account takeover, business email compromise and payment fraud. The operation involved proceedings in the United States and United Kingdom, server seizure in Germany and action against service domains.

Within one 30-day window, Microsoft associated more than 7,300 IP addresses and 3,700 homoglyph domains with RedVDS. It also said roughly 2,600 virtual machines sent an average of one million phishing emails per day during one month, and that since September 2025 activity had affected or accessed more than 191,000 organisations. These are Microsoft Threat Intelligence measurements, not an independently verified list of every victim.

A cybercrime product that looked like an ordinary VDS

RedVDS sold inexpensive Windows remote desktops with administrator access, cryptocurrency payment and permissive operating claims. A customer did not need to maintain a server or build an image. The ready-made host supported mailbox access, lookalike domain operations and entry into existing email threads.

The most useful operational detail was the cloned Windows Server 2022 image. Many hosts shared the hostname WIN-BUNS25TD77J, identifiers and product keys. A scaling shortcut became an infrastructure fingerprint. It should not trigger a block alone, but combined with an ASN, fresh domain and mail behaviour it creates a strong analytic.

A similar domain, not the same domain

In BEC, an actor compromises one party’s mailbox or registers a domain differing by one character. They observe the conversation, learn the invoice rhythm and replace payment details at the right moment. No malware is required; the message carries genuine context and urgency.

Technical controls include lookalike-domain monitoring, DMARC, risk controls for newly registered domains, and alerts on mailbox-rule changes and unusual sessions. The most important process control is simpler: confirm every bank-detail change through a previously known number, not a contact supplied in the email. Our business email compromise guide covers the workflow.

Hunting shared infrastructure

Move beyond one IP and assemble a profile:

• domain age, character similarity and absent history,
• TLS certificates and shared registration artefacts,
• device and hostname identifiers visible in EDR,
• recurring mail headers, timezone and RDP client characteristics,
• multiple customer accounts signing in from a narrow network range.

After a disruption, actors can migrate to another provider. Durable defence therefore relies on behaviour rather than the “RedVDS” label. It is also worth monitoring brand exposure through external attack surface management.

RedVDS demonstrates cloud economics for attackers: standardisation reduces campaign cost but creates common artefacts. Good threat hunting exploits those artefacts, while finance controls stop fraud even after a message passes filters. We can test both layers in an authorised campaign.

Why thread hijacking beats a fresh email

A new message from “the CEO” may look suspicious. A reply inside an existing chain contains the real subject, signatures, order and participants. The actor copies context and changes one process detail, so detection based only on words such as “urgent” or “wire” has limited value.

Hunt for mailbox rules hiding supplier replies, marking mail read or moving it to RSS and archive folders. Review OAuth applications, mailbox delegation and legacy protocols. A token may preserve access after a password change.

A finance-team procedure

Bank-detail changes should create a separate four-eyes task. Verification uses contact data from the supplier master system, not the email signature. Above a threshold, require fresh authentication and a delay that permits transaction recall.

After a suspicious payment, minutes matter. Contact the bank, preserve full headers and report to the appropriate authority. Do not reply through the compromised thread because the attacker may control the mailbox.

Measuring control effectiveness

Do not use “phishing emails blocked” as the main KPI. Measure time from payment-detail change to independent verification, supplier callback coverage, session-revocation time and lookalike domains discovered before use. An exercise should end with a finance decision, not just an employee click.

Does voice cloning defeat callbacks? It can undermine calls to unknown numbers or voice-only trust. Use a previously recorded channel, a known person, process-specific questions and multiple approvers.

---

Primary sources: Microsoft Threat Intelligence — Inside RedVDS, Microsoft — coordinated legal disruption.