Microsoft Disrupts Global Phishing Network Targeting 75,000 Organizations
Microsoft Corporation (NASDAQ:MSFT) and Health-ISAC have taken down key infrastructure supporting cybercrime operations YAM Store, CoGUI, and Iron Man. Following a legal order from a U.S. court, investigators seized and redirected web domains used by the platforms, which sold stolen login credentials and phishing toolkits to illicit buyers accepting digital tokens like USDT, ETH, and USDC.
The targeted infrastructure enabled fraudsters to transmit more than 1 billion phishing communications across more than 150 nations since January, collecting tens of millions of dollars in revenue. In response to the threat, Microsoft shut down over 20,000 associated user accounts and maintains active blocks against more than 100,000 fraudulent and spoofed domains. Blockchain analytics firm TRM Labs helped identify and freeze linked digital assets, though the total monetary value was not specified.
Investors and security professionals should track how effectively cloud and enterprise platforms prevent residual spoofing attempts, as well as whether law enforcement agencies make additional cryptocurrency seizures connected to these phishing networks. Microsoft shares fell 1.93% to $529 today.
Key points
- Microsoft and Health-ISAC obtained a U.S. court order to seize domains linked to YAM Store, CoGUI, and Iron Man.
- The cybercrime platforms facilitated over 1 billion phishing messages sent across more than 150 countries since January.
- Operators earned tens of millions in revenue, accepting digital currencies such as USDT, ETH, and USDC.
- Microsoft disabled over 20,000 accounts and continues to block more than 100,000 spoofed domains.
Written by our AI from expert market sources across the web. It can contain mistakes: check the facts before acting on them. Write-ups powered by the free AI API at FreeTheAI.org
How we writeDisclaimerQuestions and answers
How did Microsoft disrupt the phishing network?
Microsoft and Health-ISAC obtained a U.S. court order to seize and redirect domains used by YAM Store, CoGUI, and Iron Man, while disabling over 20,000 accounts and blocking 100,000 spoofed domains.
What payment methods did the cybercrime services accept?
The phishing services accepted digital currencies including USDT on the Tron network, ETH, and USDC for selling stolen credentials and tools.
How widespread was the phishing operation?
The services helped send over 1 billion phishing emails since January, reaching targets in more than 150 countries and generating tens of millions of dollars.