Microsoft and Google Take Down $66 Million Cybercrime Marketplace

Microsoft and Google have worked together to disrupt a major cybercrime marketplace that allegedly helped criminals launch phishing campaigns, business email compromise attacks and other online scams.

The marketplace, known as RedVDS, sold access to virtual machines (VMs) that came with software and tools used for cybercrime. The service allowed criminals to quickly set up systems for attacks while making it harder for investigators to trace their activities.

Microsoft’s Digital Crimes Unit monitored RedVDS and gathered information about its activities. The company then shared threat data with Google through the Global Signal Exchange (GSE), a secure platform designed to help technology companies exchange information about cyber threats.

Microsoft and Google Take Down $66 Million Cybercrime Marketplace

Microsoft took legal action in January 2026 and obtained court orders in the United States and the United Kingdom to seize RedVDS domains. The operation also involved the seizure of servers linked to the marketplace.

Google used the shared information to identify related accounts operating across its services and suspended them. Authorities also seized RedVDS servers in Germany, while Europol took action against servers located elsewhere in Europe.

The scale of the operation was significant. According to the information released about the takedown, RedVDS-provided virtual machines targeted around 130,000 organizations between September and December 2025. During the same period, about 191,000 Microsoft email accounts were compromised.

RedVDS reportedly offered access to basic virtual machines prepared for scams for as little as $24 per month. This low cost allowed cybercriminals to gain access to ready-to-use infrastructure without having to build their own systems.

The case also highlights the growing role of information sharing in fighting online crime. Large technology companies can see different parts of a cyberattack, but sharing those signals can help connect otherwise separate incidents.

See Also: Fake Microsoft Teams IT Support Calls Used to Spread EtherRAT Malware

The Global Signal Exchange is a UK-based nonprofit organization that was co-founded with Google in 2025. It aims to provide a secure way for organizations to share information about cybercrime and threats in real time.

The RedVDS operation is one example of how this type of collaboration can help companies identify criminal infrastructure and take action across multiple platforms and jurisdictions.

Microsoft and Google are expected to continue sharing threat information through the GSE. The organization also works with other major technology companies, including Meta and Amazon, as part of its broader effort to improve cooperation against cybercrime.