Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations

Microsoft disrupted cryptocurrency-accepting cybercrime suppliers linked to more than one billion phishing messages worldwide this year.

The company and cybersecurity group Health-ISAC secured a US court order to seize and redirect domains supporting YAM Store, CoGUI and Iron Man, three services that sold accounts and phishing tools to fraudsters, according to an Oct. 14 statement.

Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and was continuing to block more than 100,000 impersonation and fraud domains. Since January, the services helped criminals send messages targeting more than 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators.

The investigation began after Japan's National Police Agency alerted Microsoft to scams targeting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could purchase the infrastructure needed to run phishing operations without building it themselves.

YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations, then used the seemingly legitimate websites to obtain Microsoft 365 accounts for resale.

CoGUI and Iron Man supplied ready-made phishing pages and messages that mimicked banks, retailers, transport authorities, and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates, allowing customers to tailor scams to brands and countries.

Crypto payments and a wider infrastructure crackdown

Microsoft's technical investigation found that the services accepted cryptocurrency, including Tether's USDT and Ethereum. YAM Store's storefront supported USDT on the Tron network alongside Alipay and WeChat Pay, while Cloudflare said buyers could also pay for marketplace offerings with USDC.

The payment options gave customers multiple channels to buy compromised credentials and phishing services. YAM Store also maintained a sub-reseller tier, expanding the distribution of accounts and infrastructure beyond its own storefront.

Blockchain analytics firm TRM Labs said its intelligence helped investigators locate assets linked to the group and freeze them. The company did not specify the value of the frozen assets, leaving the operation's immediate financial damage unclear.

The enforcement effort also targeted services criminals used after making their purchases. Cloudflare said it suspended accounts, disabled Workers projects supporting phishing pages, and banned hundreds of associated domains and projects. It placed warning pages in front of malicious links where it couldn't seize domains.

Microsoft also identified a dependency in Iron Man's subscription business: customers bought access to phishing software connected to a vendor-controlled licensing server. Disabling that infrastructure could interfere with customers' ability to use purchased kits, even if copies remained in circulation.

The crackdown involved Japan's police and Cybercrime Control Center, along with Oracle, Proofpoint, Resecurity, and US law-enforcement partners. Microsoft said the targeted suppliers were part of a larger criminal network, with related infrastructure still being removed.

The next challenge is limiting how quickly suppliers can replace seized domains and compromised accounts. Cloudflare said some domain registrars operate in jurisdictions that make legal seizures difficult, so it must block access through security warnings even as those domains remain online.