[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-microsoft-and-google-take-down-66m-cybercrime-vm-marketplace":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},7165,"microsoft-and-google-take-down-66m-cybercrime-vm-marketplace","Microsoft and Google Take Down $66M Cybercrime VM Marketplace","A shared threat-intelligence network let Microsoft and Google dismantle a $66 million marketplace that rented disposable virtual machines to scammers.","Microsoft and Google shut down a $66 million marketplace that rented out disposable virtual machines built for scams.\n\nRedVDS sold access to virtual machines pre-loaded with unlicensed software, ready-made for phishing and business email compromise campaigns. Between September and December 2025, RedVDS-provided VMs were used against roughly 130,000 organizations, and 191,000 Microsoft email accounts were compromised in the process. Microsoft's Digital Crimes Unit tracked the operation for months before petitioning courts in the UK and US in January 2026 to seize its web domains. Threat data shared through the Global Signal Exchange, a nonprofit Microsoft and Google co-founded in 2025, let Google suspend related accounts on its own platforms, while German authorities impounded servers and Europol moved against RedVDS infrastructure in Europe.\n\nA basic scam-ready VM cost $24 a month - cheaper than most streaming bundles - which goes a long way toward explaining how 130,000 organizations got hit in just four months. The bigger story isn't the takedown itself but the mechanism behind it: two companies that compete hard for search, cloud, and productivity customers routed sensitive threat data through a shared, secure pipe instead of sitting on it. That's not how these companies usually treat each other's business.\n\nCybercrime marketplaces get seized on a fairly regular basis. Microsoft and Google actually comparing notes in real time is the rarer part, and it's worth watching whether other Global Signal Exchange partners like Meta and Amazon put the pipe to use before the next RedVDS opens for business.","[\"cybercrime\",\"phishing\",\"microsoft\",\"google\"]","2026-09-21T18:20:00.000Z","2026-09-21T18:49:02.478Z","2026-09-21T18:49:15.871Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The closing claim that 'Microsoft's own email platform was the primary target' is an unsupported leap from the source—191,000 Microsoft accounts were compromised, but RedVDS targeted 130,000 organizations broadly for phishing\u002FBEC generally, not Microsoft specifically, so either support this framing with a source citation or cut it.","resolved","security",[32,33,34,35],"cybercrime","phishing","microsoft","google",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fmicrosoft-google-took-down-usd66-million-cybercrime-marketplace-that-sold-virtual-machines-with-free-software",0,{"sections":42},[43,48,51,56,61,66,71,76,81,86,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",4180,"2026-09-21T17:30:24.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":18},"Security",686,{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",357,"2026-09-21T20:29:45.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",186,"2026-09-21T17:13:06.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",162,"2026-09-21T17:08:52.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",130,"2026-09-20T13:48:11.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",102,"2026-09-21T18:26:11.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Dev Tools","dev-tools",78,"2026-09-18T04:00:00.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Startups","startups",57,"2026-09-21T18:23:05.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",42,"2026-09-18T22:35:10.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",24,"2026-09-21T17:00:25.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]