Microsoft, working alongside cybersecurity partners, has disrupted a large-scale phishing operation that accepted cryptocurrency payments and targeted thousands of organizations worldwide. The action took down infrastructure connected to YAM Store, CoGUI, and Iron Man — three services that furnished criminals with fraudulent accounts and ready-made phishing tools. Since January 2026, the network has enabled more than 1 billion malicious messages across more than 150 countries.

Microsoft announced the operation on October 14 in an official blog post, following an investigation conducted with Health-ISAC, an information-sharing community for the global health sector, and international law enforcement agencies. The company estimates the services generated tens of millions of dollars for their operators. More than 750 million phishing messages specifically targeted Microsoft customers. The structure Microsoft describes — vendors selling accounts, templates, and delivery tools to a broad criminal customer base — reflects the cybercrime-as-a-service model that has lowered the technical barrier to running phishing campaigns at industrial scale.

USDT Payments Supported Cybercrime Operations

YAM Store functioned as an underground marketplace selling fraudulently obtained Microsoft and Google accounts, which criminals purchased to distribute phishing messages and impersonate legitimate organizations. The marketplace accepted multiple payment methods, including Tether's USDT stablecoin on the Tron network. USDT is a dollar-pegged stablecoin — a cryptocurrency designed to track the value of the U.S. dollar — and Tron is among the blockchain networks that host its transfers.

Microsoft's investigation also identified cryptocurrency payments involving Ethereum across the broader criminal ecosystem. These payment options allowed operators to sell phishing infrastructure to customers across different jurisdictions.

CoGUI and Iron Man, meanwhile, supplied ready-made websites and messages designed to steal passwords and financial information. Investigators discovered more than 2,300 Iron Man templates impersonating banks, retailers, government agencies, and healthcare providers. Kits of this kind route victims to counterfeit login and payment pages, where entered credentials and financial details pass directly to attackers.

Microsoft Seizes Domains and Disables Thousands of Accounts

Microsoft and Health-ISAC obtained authorization from the U.S. District Court for the Southern District of Florida to disrupt the network. Civil court orders of this kind are a recurring tool in large-scale disruption operations, giving private companies legal standing to seize and redirect domains that sit outside their own networks. The partners seized and redirected domains supporting the three services, cutting off access to their infrastructure.

Microsoft has already disabled more than 20,000 accounts associated with YAM Store and continues blocking more than 100,000 fraudulent domains used for impersonation and phishing attacks.

The investigation began after Japanese authorities identified suspicious messaging campaigns targeting local organizations in late 2025. International cooperation subsequently uncovered a broader criminal marketplace serving fraudsters worldwide.

Crypto Payments Highlight Growing Cybercrime Risks

The case underscores how cryptocurrency payments can support commercial cybercrime operations. Stablecoins such as USDT enable convenient cross-border transfers, making them attractive to legitimate businesses and criminal marketplaces alike. The investigation, however, does not establish that cryptocurrency transactions accounted for all of the network's revenue, and the disruption primarily targeted phishing infrastructure rather than the underlying blockchain payment systems.

Microsoft's intervention represents a significant effort to weaken the services supplying large-scale online fraud. Even so, the broader threat persists, as criminals continue seeking alternative infrastructure and payment channels. Microsoft's account disabling and domain blocking remain ongoing, so subsequent disclosures from the company, Health-ISAC, or partner law enforcement agencies may add to the public picture of the network's reach.