Microsoft and partners disrupt network behind more than 1 billion phishing messages

BleepingComputer reported on 14 October 2026 that police agencies and private partners had disrupted a Chinese-language cybercrime ecosystem behind more than 1 billion malicious messages, sent to over 75,000 organizations in 150 countries. The investigation was started by Microsoft and Japan's National Police Agency, and Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs also took part.

• Acting on a court order from the Southern District of Florida in the US, Microsoft and Health-ISAC took over and redirected the domains behind the YAM Store marketplace and the CoGUI and Iron Man phishing kits.
• Microsoft shut down more than 20,000 YAM Store-linked accounts and blocked 100,000 domains used for impersonation and fraud; YAM Store sold compromised or fraudulently obtained Microsoft and Google accounts.
• Since January, Microsoft customers have been the target of over 750 million malicious e-mails and text messages, the report says.
• Iron Man came with more than 2,300 templates that mimic banks, retailers, delivery firms and government agencies.

Why it matters

According to the report, the people running YAM Store bought expired domains of real organizations, rebuilt their websites, obtained cloud accounts under those identities and misused SharePoint and OneDrive storage in compromised Microsoft environments for hosting. Microsoft says many of the messages aimed at Microsoft 365 customers relied on device-code phishing to steal authentication tokens. This is a reminder that a link from a cloud address that looks trusted can still be malicious, and staff training at companies in Türkiye could usefully cover this method.

The kits' lures ranged from unpaid toll and traffic fine notices to delivery problems and account verification requests. Removal of the remaining infrastructure is reported to be ongoing after the operation.