Microsoft, Google took down $66 million cybercrime marketplace that sold virtual machines with free software

So-called signal sharing between Microsoft and Google uncovered the RedVDS marketplace was behind large-scale cyber fraud RedVDS sold access to virtual machines running unlicensed software from which cybercriminals launched scams and directed attacks Threat data was shared securely via the Global Si

<![CDATA[ <article> <ul><li><strong>So-called signal sharing between Microsoft and Google uncovered the RedVDS marketplace was behind large-scale cyber fraud</strong></li><li><strong>RedVDS sold access to virtual machines running unlicensed software from which cybercriminals launched scams and directed attacks</strong></li><li><strong>Threat data was shared securely via the Global Signal Exchange (GSE), a non-profit organization</strong></li></ul><p>A major cybercrime marketplace has been taken out of action thanks to cooperation between Microsoft and Google via a secure threat data sharing platform.</p><p>Known as the Global Signal Exchange, the collaboration led to the take-down of the RedVDS, an online cybercrime mall supplying virtual machines for launching phishing, business email compromise attacks, and more.</p><p>The marketplace – which provided quickly-deleted and therefore virtually untraceable VMs – was meticulously monitored by Microsoft’s security team, Digital Crimes Unit, with both Microsoft and Google suspending the operation and action taken to seize domains and servers.</p><p>A secondary case featuring the GSE identified a Microsoft-impersonating tech support scam, resulting, highlighting the importance of secure thread data collaboration platforms.</p><h2 id="digital-crimes-unit">Digital Crimes Unit</h2><p>Finding massive scams is not easy. Even with its own Digital Crimes Unit, Microsoft has to rely on information sharing with third party organizations. In this case, the RedVDS marketplace was identified ahead of disruptive action taken by Microsoft in January 2026, which applied to courts in the UK and US to have the RedVDS web domains seized. </p><p>Data shared via the GSE enabled Google to follow suit, identifying related accounts on its networks and suspending them. Meanwhile, servers were impounded in Germany, and Europol took action against Europe-based RedVDS servers.</p><p>It’s an impressive account of cooperative, decisive action against cybercrime, a collaborative response to what has been described as a “$66 million fraud marketplace.”</p><p>An incredible 130,000 organizations were targeted by RedVDS-provided virtual machines between September and December 2025, with 191,000 Microsoft email accounts compromised during this period. All of this access to cybercrime was available from just $24 a month for a basic scam-ready virtual machine.</p><h2 id="the-importance-of-collaboration">The importance of collaboration</h2><p>The <a href="https://www.globalsignalexchange.org/" target="_blank">Global Signal Exchange</a> is a UK-based non-profit, co-founded with Google in 2025 with the aim of providing real-time monitoring of the cybercrime supply chain.</p><p>"Fraud does not respect company boundaries, and no single organization ever sees the whole picture," noted Emily Taylor, CEO at Oxford Information Labs and Co-Founder of the Global Signal Exchange.</p><p>"That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do."</p><p>The Global Signal Exchange’s role in the sharing of information between Google and Microsoft has highlighted the importance in such collaborations. Both organizations have stated they plan to continue sharing information through the GSE, whose other partners include Meta, Amazon, Google, among many others.</p> </article> ]]>