Microsoft has identified a network of phishing suppliers that accept Tether (USDT) as payment, and has linked the tools those suppliers provide to campaigns used against as many as 75,000 organizations. The finding highlights how criminal service providers are using stablecoins to collect payment, and how that payment model helps fuel phishing attacks at industrial scale.

Suppliers in a Phishing-as-a-Service Model

According to Microsoft, the identified parties operate as suppliers within a phishing-as-a-service model. This means they do not necessarily run every attack themselves. Instead, they sell or lease ready-made phishing tools to other criminals who carry out the actual campaigns. This division of labor, in which tool builders serve customer criminals rather than attacking directly, is a structure researchers have observed across other criminal service markets, and it lowers the technical skill needed to run convincing campaigns.

A reported characteristic of these suppliers is that they accept USDT, the US dollar-pegged stablecoin issued by Tether, as a form of payment. A stablecoin is a cryptocurrency designed to hold a fixed value, in this case one US dollar per token. That price stability matters in this context because it removes the volatility risk of holding more volatile cryptocurrencies between payment and cash-out. Accepting USDT allows suppliers to receive payment without touching traditional bank accounts, which can be harder for investigators to trace than conventional wire transfers.

Microsoft's finding concerns a specific criminal marketplace rather than cryptocurrency payments broadly. USDT acceptance is a reported attribute of these particular suppliers; it does not mean that ordinary USDT transactions are suspicious, and Tether itself is a widely used financial tool with legitimate applications. The pattern is nonetheless consistent with Microsoft's earlier security research, including a prior warning about crypto malware campaigns that evolved from simple theft tools into more sophisticated backdoors.

How the Tools Connect to 75,000 Organizations

Microsoft reported that the phishing tools supplied by the identified parties were used against as many as 75,000 organizations. The figure describes potential campaign reach, meaning organizations that were targeted or exposed to attacks using these tools, not necessarily organizations that were fully compromised.

The distinction matters. Being targeted by a phishing campaign does not automatically mean an organization's accounts or data were accessed. The scale of 75,000 organizations does, however, illustrate how widely a supplier model can spread attack capability: a small number of suppliers can enable a far larger number of campaigns run by separate criminal operators who purchase or rent the tools.

Based on the available information, Microsoft has not publicly detailed which industries or regions these 75,000 organizations belong to. Inferring geography, sector breakdowns, or confirmed victim counts beyond what Microsoft attributed would go beyond what the evidence supports.

What This Means for Organizations and Crypto Users

The finding underscores how phishing-as-a-service marketplaces operate similarly to legitimate software-as-a-service businesses, complete with suppliers, customers, and payment rails. Cryptocurrency, and stablecoins in particular, can appear as a payment method in these illicit marketplaces because transactions can cross borders quickly and outside the traditional banking system.

Phishing remains one of the most commonly reported ways for attackers to gain an initial foothold in organizations, since a single harvested credential can enable account takeover and follow-on fraud. For organizations, the practical response is the same regardless of how suppliers get paid:

• Verify the sender before clicking any link in an email or message.
• Check that login pages use the correct domain.
• Enable phishing-resistant multi-factor authentication, which requires a physical key or device confirmation rather than a code sent by text message.
• Report suspicious messages to your IT or security team rather than dismissing them.

For users of USDT or other stablecoins, Microsoft's finding is a reminder that cryptocurrency payment rails are part of the modern criminal economy, even though the vast majority of stablecoin activity is legal. Awareness of how these markets work helps explain why security researchers and law enforcement are paying close attention to on-chain payment patterns connected to cybercrime. Related Microsoft security research has previously shown how cryptocurrency theft tools can evolve into persistent threats for both individuals and organizations.

Anyone who receives an unexpected login request, a message urging them to verify credentials, or an email asking them to click a link to secure an account should treat it with caution. These are common delivery mechanisms for the kind of phishing campaigns described in Microsoft's research. Follow-up advisories, published indicators, or enforcement actions targeting supplier networks like this one would offer a clearer picture of how the ecosystem develops, which is why security teams and researchers tend to monitor vendor threat intelligence channels after disclosures of this kind.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.