In a dramatic turn of events, the Nigeria Police Force has sensationally arrested Okitipi Samuel, a Nigerian national accused of masterminding a high-profile cyberattack that rocked Microsoft 365 users across the globe. The arrest, which comes after a sweeping investigation, has sent shockwaves through the tech world and raised serious questions about the safety of digital infrastructure worldwide.

Police spokesperson Benjamin Hundeyin revealed that the case began with a major data breach at Microsoft, where hackers brazenly accessed sensitive customer data. The breach was so severe that it forced Microsoft to call in the FBI, the US Secret Service, and the UK’s National Crime Agency, all scrambling to track down the culprits behind this international cyber scandal.

According to the police, the National Cybercrime Centre (NCCC) led the charge, uncovering that the attack was carried out using a notorious phishing toolkit called Raccoon0365. This tool allegedly allowed the suspects to create fake Microsoft login pages, tricking users into handing over their credentials and giving the hackers free rein over the email accounts of major corporations, banks, and schools.

Hundeyin claimed that the investigation kicked off after Microsoft’s US office, via the FBI, tipped off Nigerian authorities about the use of Raccoon0365 in a string of phishing attacks. These emails, disguised as legitimate Microsoft messages, reportedly duped countless users into giving up their passwords, which were then used for a range of cybercrimes, from business email compromise to large-scale data breaches.

Between January and September, a wave of unauthorised access to Microsoft 365 accounts was traced back to these phishing campaigns. The NCCC, working hand-in-hand with Microsoft and international agencies, used digital forensics and cryptocurrency tracking to uncover a web of crypto wallets allegedly tied to the operation.

Acting on what they called “actionable intelligence,” police swooped in on locations in Lagos and Edo states, arresting three suspects: Joshua, James, and the alleged kingpin, Okitipi Samuel. Authorities say the arrests followed a deep dive into digital evidence, including suspicious crypto wallets and devices seized from the suspects’ homes.

Investigators have painted Okitipi Samuel, also known as “0365” and Moses Felix, as the brains behind the operation. He is accused of running a Telegram channel where he sold phishing links for cryptocurrency and hosting fake Microsoft login pages using stolen email addresses, enabling widespread account takeovers.

In a surprising twist, police now say that Joshua and James were actually victims of identity theft, with no evidence linking them to the cyber scheme. Their names, authorities claim, were used without their knowledge, clearing them of any wrongdoing in the case.

Meanwhile, the evidence against Okitipi Samuel is stacking up. Police say he faces a laundry list of charges, including identity theft, hacking, creating and distributing malware, and facilitating fraud. He is expected to be prosecuted under Nigeria’s cybercrime laws, but officials have hinted that extradition could be on the table if foreign governments make a formal request.

Hundeyin was quick to assure the public that the Nigeria Police Force, under Inspector-General Kayode Egbetokun, is on high alert and fully committed to protecting the nation’s digital space from cyber threats.

In a related move, the Director of the National Cybercrime Centre issued a public warning, urging Nigerians to be vigilant online and avoid clicking suspicious links or sharing personal information. He stressed the need for everyone to double-check sources before responding to emails or messages, as cybercriminals are getting more sophisticated by the day.

This headline-grabbing case has put the spotlight on Nigeria’s growing cybercrime problem and the urgent need for international cooperation. The successful bust, authorities say, proves that Nigerian law enforcement is ready to take on even the most complex digital threats, sending a clear message to cybercriminals everywhere: you can run, but you can’t hide.