Global takedown dismantles network behind a billion phishing messages

Law enforcement agencies and partners around the world have disrupted a sprawling cybercriminal ecosystem that enabled more than a billion malicious messages. Its victims numbered over 75,000 organizations across 150 countries. Since the start of the year alone, more than 750 million such messages — sent by email and SMS — were aimed at Microsoft customers.

An underground phishing factory

The investigation was opened by Microsoft and Japan's National Police Agency (NPA) after a wave of fraud drew their attention. It uncovered a sprawling Chinese-language cybercrime marketplace selling tools and services for phishing campaigns. The activity was traced to YAM Store (Storm-3119) and then linked to the CoGUI, Haozi, and Iron Man System phishing kits, collectively tracked as Storm-2990.

According to Microsoft, YAM Store sold compromised or fraudulently obtained Microsoft and Google accounts, licenses, and storage. Its operators bought up expired domains of real organizations and rebuilt their sites so that defunct companies appeared active, then used those identities to obtain cloud accounts. Another trick was fabricating fake organizations, complete with content and documentation, using AI tools.

Ready-made deception kits

The phishing kits offered criminals a wide range of lures: unpaid tolls, traffic fines, delivery problems, account verification requests. They supported geofencing, fake CAPTCHA gates, IP filtering, and other measures to obstruct analysis. CoGUI targeted victims in the United States and Japan, but by mid-2026 it was pushed aside by Iron Man, which offered over 2,300 templates impersonating banks, retailers, delivery services, and government agencies.

Resecurity, which also took part in the investigation, found an exposed container registry with 911 builds at Iron Man, along with a payment-card capture subsystem — a catalog of 2,360 phishing packages covering 130 countries/areas, updated through October 1, 2026. Many messages aimed at Microsoft 365 customers used device-code phishing to steal authentication tokens.

Striking the infrastructure

Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected the domains supporting YAM Store, CoGUI, and Iron Man. The company deactivated more than 20,000 accounts tied to YAM Store and blocked 100,000 domains used for impersonation and fraud. More infrastructure is still being removed; the operation also involves Japanese authorities, JC3, Cloudflare, Oracle, Proofpoint, and TRM Labs.

Source: Bleeping Computer