Microsoft dismantles crypto-paid phishing network that targeted 75,000 organizations
Phishing supply chain hit by court-backed takedown
Microsoft and cybersecurity group Health-ISAC obtained a US court order to seize and redirect the domains behind three criminal services: YAM Store, CoGUI and Iron Man. These services sold stolen accounts and phishing tools — fake login pages and messages designed to trick people into handing over passwords — to fraudsters.
Microsoft said in an Oct. 14 statement that the network was tied to more than one billion phishing messages sent worldwide this year. Since January, the services helped criminals send messages targeting more than 75,000 organizations in over 150 countries, and generated tens of millions of dollars for their operators.
Key numbers
- More than 20,000 accounts linked to YAM Store disabled by Microsoft
- More than 100,000 impersonation and fraud domains still being blocked
- More than 75,000 organizations targeted across more than 150 countries
- More than 2,300 Iron Man phishing templates identified
What Microsoft's announcement says
Microsoft said the investigation started after Japan's National Police Agency alerted it to scams hitting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could buy ready-made infrastructure instead of building it themselves.
YAM Store sold fraudulently obtained Microsoft and Google accounts, cloud resources and hosting. According to Microsoft, some operators revived expired web domains belonging to nonprofits and educational groups, then used those seemingly legitimate sites to obtain Microsoft 365 accounts for resale.
CoGUI and Iron Man supplied ready-made phishing pages and messages imitating banks, retailers, transport authorities and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates, letting buyers tailor scams to specific brands and countries.
Microsoft's technical work also found a weak point in Iron Man's business: customers paid for access to phishing software that depended on a licensing server controlled by the vendor. Disabling that server could break purchased kits even if copies were still circulating.
Crypto payments and the wider crackdown
Microsoft found the services accepted cryptocurrency, including Tether's USDT (a stablecoin, a digital token designed to hold a steady value) and Ethereum. YAM Store's storefront supported USDT on the Tron network alongside Alipay and WeChat Pay, and Cloudflare said buyers could also pay with USDC.
Blockchain analytics firm TRM Labs said its intelligence helped investigators locate assets linked to the group and freeze them. The company did not say how much was frozen. Cloudflare said it suspended accounts, disabled Workers projects that supported phishing pages, and banned hundreds of related domains, placing warning pages in front of malicious links where it could not seize domains.
The effort also involved Japan's police and Cybercrime Control Center, Oracle, Proofpoint, Resecurity, and US law-enforcement partners.
What is still unclear
The overall financial damage is not known. TRM Labs did not disclose the value of the frozen assets. Microsoft said the targeted suppliers were part of a larger criminal network, and that related infrastructure is still being removed, so the full scope remains unsettled.
Why this matters for crypto users
The case shows crypto being used as a payment rail for cybercrime services, alongside conventional payment apps. Stablecoins gave buyers multiple ways to pay for stolen credentials and phishing kits. At the same time, blockchain tracing helped investigators find and freeze funds, which is why analytics firms take part in such operations.
The next problem: replacing seized ground
Cloudflare said the main remaining challenge is how fast suppliers can swap in new domains and accounts. Some domain registrars operate in jurisdictions that make legal seizures difficult, so Cloudflare said it must block access through security warnings even when those domains stay online.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Argus Token Surges Over 780% in 30 Days Amid Mixed Market Signals
Dallas Fed economists warn tokenized deposits may increase US credit costs
US Sanctions Iranian Exchange BitBank Over IRGC Bitcoin Transfers
