Microsoft on Thursday announced significantly disrupting the ONNX phishing service and made public the name of an Egyptian man who allegedly runs it. 

According to the tech giant, an individual named Abanoub Nady (aka MRxC0DER) has developed and sold phishing kits under the ONNX brand. 

Nady was previously unmasked by dark web monitoring platform Dark Atlas in July 2024, but having his identity exposed by a major company such as Microsoft is likely to have a bigger impact. Microsoft has decided to name the suspect in an effort to deter other threat actors. 

Microsoft has been tracking cybercrime operations linked to Nady since 2017. The company says he has been involved in the development and sale of several phishing services, including ONNX, Caffeine and, more recently, FUHRER.

The phishing kits, offered through a phishing-as-a-service model for prices starting at $150 per month, enable users to create and send out phishing emails in large-scale campaigns. Cybercriminals can use these phishing attacks to collect users’ credentials.

The ONNX operation also fueled adversary-in-the-middle (AitM) phishing, where the attacker intercepts authentication between users and a legitimate service, enabling them to bypass protections such as multi-factor authentication. 

Microsoft said it seized 240 domains associated with services run by Nady, significantly disrupting the cybercrime operations. Seizing the domains was possible with the aid of the Linux Foundation, which owns the ONNX name and logo for its Open Neural Network Exchange. The Linux Foundation joined Microsoft in a lawsuit targeting the phishing operations.  

“Through a civil court order unsealed today in the Eastern District of Virginia, this action redirects the malicious technical infrastructure to Microsoft, severing access of threat actors, including the fraudulent ONNX operation and its cybercrime customers, and permanently stopping the use of these domains in phishing attacks in the future,” Microsoft explained.

“While today’s legal action will substantially hamper the fraudulent ONNX’s operations, other providers will fill the void, and we expect threat actors will adapt their techniques in response.

“However, taking action sends a strong message to those who choose to replicate our services to harm users online: we will proactively pursue remedies to protect our services and our customers and are continuously improving our technical and legal strategies to have greater impact,” it added. 

Related: RedLine and Meta Infostealers Disrupted by Law Enforcement

Related: Anonymous Sudan DDoS Service Disrupted, Members Charged by US

Related: Russia Arrests 96 People Tied to US-Disrupted Cryptocurrency Exchanges

Related: Radar/Dispossessor Ransomware Operation Disrupted by Authorities