The suspected Chinese schemers behind it enable those constant fake E-Z Pass and U.S. Postal Service smishing messages.

The China-linked operation has grown from a phishing kit marketplace into an active and growing community supporting a decentralized large-scale phishing ecosystem.

The company acted on a court order and collaborated with Cloudflare to seize RaccoonO365’s infrastructure, which was used to steal credentials from organizations in 94 countries.

Also known as “Saim Raza,” the group was allegedly responsible for over $3 million in losses.