Microsoft, Google take down $66 million RedVDS cybercrime marketplace
Microsoft and Google, through the Global Signal Exchange, helped dismantle RedVDS, a $66 million cybercrime marketplace that sold virtual machines for phishing and fraud.
RedVDS sold access to virtual machines running unlicensed software, the report said. The VMs were designed to be quickly deleted and therefore virtually untraceable. A basic scam-ready virtual machine was available from just $24 a month. Between September and December 2025, 130,000 organizations were targeted by RedVDS-provided virtual machines, and 191,000 Microsoft email accounts were compromised during that period.
Microsoft’s Digital Crimes Unit monitored the marketplace. In January 2026, Microsoft took disruptive action and applied to courts in the United Kingdom and the United States to have RedVDS web domains seized. Data shared through the Global Signal Exchange then enabled Google to identify related accounts on its networks and suspend them. Servers were impounded in Germany, and Europol took action against Europe-based RedVDS servers.
The Global Signal Exchange is a UK-based non-profit co-founded with Google in 2025 to provide real-time monitoring of the cybercrime supply chain. Its partners include Meta, Amazon, Google and others, according to the report. Emily Taylor, chief executive of Oxford Information Labs and co-founder of the Global Signal Exchange, said: "Fraud does not respect company boundaries, and no single organization ever sees the whole picture." She added: "That is exactly why we built GSE: to give trusted partners a secure way to share what they know, quickly. These two cases are a good example of GSE doing exactly what it was designed to do."
A secondary case involving the exchange identified a Microsoft-impersonating tech support scam, the report said. Both Microsoft and Google have said they plan to continue sharing information through the Global Signal Exchange.