Microsoft Shuts Down USDT-Linked Phishing Network Behind 1 Billion Scam Messages
Microsoft and cybersecurity partners have dismantled a major phishing network that accepted cryptocurrency payments and targeted thousands of organizations worldwide. The operation disrupted YAM Store, CoGUI, and Iron Man, three services that supplied criminals with fraudulent accounts and phishing tools. Since January 2026, the network enabled more than 1 billion malicious messages across over 150 countries.
Microsoft announced the operation on October 14, following an investigation involving Health-ISAC and international law enforcement agencies. The company estimates that the services generated tens of millions of dollars for their operators. More than 750 million phishing messages specifically targeted Microsoft customers.
USDT Payments Supported Cybercrime Operations
YAM Store operated as an underground marketplace selling fraudulently obtained Microsoft and Google accounts. Criminals purchased these accounts to distribute phishing messages and impersonate legitimate organizations. The marketplace accepted several payment methods, including Tether’s USDT stablecoin on the Tron network.
Microsoft’s investigation also identified cryptocurrency payments involving Ethereum across the broader criminal ecosystem. These payment options allowed operators to sell phishing infrastructure to customers across different jurisdictions.
Meanwhile, CoGUI and Iron Man provided ready-made phishing websites and messages designed to steal passwords and financial information. Investigators discovered more than 2,300 Iron Man templates impersonating banks, retailers, government agencies, and healthcare providers.
Microsoft Seizes Domains and Disables Thousands of Accounts
Microsoft and Health-ISAC obtained authorization from the U.S. District Court for the Southern District of Florida to disrupt the network. The partners seized and redirected domains supporting the three services, restricting access to their infrastructure.
Microsoft has already disabled more than 20,000 accounts associated with YAM Store. Additionally, the company continues blocking over 100,000 fraudulent domains used for impersonation and phishing attacks.
The investigation began after Japanese authorities identified suspicious messaging campaigns targeting local organizations in late 2025. International cooperation subsequently uncovered a broader criminal marketplace serving fraudsters worldwide.
Crypto Payments Highlight Growing Cybercrime Risks
The case highlights how cryptocurrency payments can support commercial cybercrime operations. Stablecoins such as USDT offer convenient cross-border transfers, making them attractive to legitimate businesses and criminal marketplaces alike.
However, the investigation does not establish that cryptocurrency transactions accounted for all revenue generated by the network. The disruption primarily targeted phishing infrastructure rather than the underlying blockchain payment systems.
Microsoft’s intervention represents a significant effort to weaken the services supplying large-scale online fraud. Nevertheless, the broader threat remains as criminals continue seeking alternative infrastructure and payment channels.
