Microsoft and Google dismantle $66 million RedVDS cybercrime marketplace

Microsoft and Google have successfully dismantled RedVDS, a sophisticated cybercrime marketplace responsible for an estimated $66 million in fraud. The operation, facilitated by the non-profit Global Signal Exchange (GSE), allowed the tech giants to share real-time threat intelligence to identify and neutralize the platform. RedVDS specialized in providing virtual machines pre-loaded with unlicensed software, which cybercriminals used to conduct large-scale phishing campaigns and business email compromise attacks. Between September and December 2025, the marketplace facilitated attacks against 130,000 organizations and compromised over 191,000 Microsoft accounts. Following court-ordered domain seizures in the UK and US, along with server impoundments in Germany, the operation was effectively shut down. This collaboration underscores the growing importance of cross-industry threat data sharing, with both companies pledging to continue using the GSE to combat the evolving supply chain of global cybercrime.