Global Law Enforcement Takedown Hits Phishing Network
International law enforcement agencies and industry partners have disrupted a massive cybercriminal ecosystem that facilitated more than a billion malicious messages targeting organizations worldwide.
Radwan AbdulhadiEditor and technology writer
Global Takedown Targets Phishing Infrastructure
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide, as reported by BleepingComputer.
Since the beginning of the year, more than 750 million malicious messages were aimed at Microsoft customers via email and SMS text messaging. The investigation was originally initiated following a wave of fraudulent activity discovered by Microsoft and Japan’s National Police Agency (NPA), uncovering a sprawling Chinese-language cybercrime marketplace offering specialized tools and services for phishing campaigns.
Uncovering YAM Store and Associated Phishing Kits
Investigators traced the malicious activity to YAM Store, operating as Storm-3119, an underground infrastructure marketplace. This marketplace was subsequently linked to the CoGUI, Haozi, and Iron Man System phishing kits, which are collectively tracked as Storm-2990.
According to a report published by Microsoft says, YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage. The operators acquired expired domains of real organizations, rebuilt websites to make defunct entities appear active, and utilized those identities to obtain cloud accounts. Another observed tactic involved generating fake organizations complete with content and documentation using artificial intelligence tools.
Exploitation of Cloud Storage and Advanced Lures
Within compromised Microsoft environments, the threat actors employed stolen application credentials to manage accounts and licenses, while also leveraging abused SharePoint and OneDrive storage for hosting malicious content.
The phishing kits provided cybercriminals with a broad variety of lures, including unpaid tolls, traffic penalties, delivery complications, and account verification requests. Furthermore, the kits supported geofencing, fake CAPTCHA gates, IP filtering, and additional technical measures designed to obstruct security analysis.
Evolution of Phishing Kits and Threat Intelligence
While CoGUI initially targeted victims in the United States and Japan, the Iron Man kit eventually pushed it aside by mid-2026. Iron Man offered more than 2,300 templates impersonating banks, retailers, delivery services, and government agencies.
Cybersecurity firm Resecurity also participated in the multi-agency investigation and shared more details about Iron Man after conducting deep analysis of the exposed infrastructure.
In late 2024, Proofpoint identified email campaigns that were consistently targeting Japan in connection with the CoGUI phishing kit, focusing heavily on credential and payment data theft by impersonating recognizable Japanese companies and international organizations.
Judicial Actions and Domain Seizures
Operating under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC successfully seized and redirected domains supporting YAM Store, CoGUI, and Iron Man.
Additionally, the technology giant deactivated over 20,000 accounts associated with the YAM Store marketplace and blocked 100,000 domains previously used by the cybercriminals for impersonation and fraud. Law enforcement and supporting partners continue to remove related infrastructure based on ongoing investigation findings.
Sources
- BleepingComputerGlobal takedown hits network behind 1 billion phishing messages
Continue chronologically
Related entity coverage
Related stories
Microsoft and Japan Take Down Giant Phishing Network
Microsoft and Japan's National Police Agency have dismantled a major cybercrime marketplace behind over a billion phishing messages worldwide.
Microsoft Disrupts Chinese Phishing Market Behind 1B+ Messages
Microsoft and Health-ISAC seize domains powering YAM Store, CoGUI, and Iron Man, disrupting a massive Chinese-language phishing-as-a-service market.
Microsoft Disrupts EvilTokens Phishing-as-a-Service Platform
Microsoft's Digital Crimes Unit has disrupted the EvilTokens phishing platform, which compromised 12,000 accounts across 10,000 global organizations.
Microsoft Authenticator Replaces Backup With Google One
Microsoft Authenticator for Android is replacing its own password and account backup system with Google One starting in January.
