Microsoft Disrupts Global Phishing Network Sending 1 Billion Messages
Microsoft disabled over 20,000 accounts and 100,000 domains to dismantle a commercialized cybercrime network that targeted 75,000 organizations across 150 countries.
Microsoft disrupted a global cybercrime network that sent more than 1 billion malicious messages to consumers and 75,000 organizations across 150 countries since January 2026. The operation targeted three interconnected criminal services known as YAM Store, CoGUI, and Iron Man, which functioned as a commercialized phishing ecosystem providing fraudulent templates and compromised cloud accounts to impersonate government agencies, retailers, and banks.
Working with the National Police Agency of Japan and Health-ISAC, Inc., the company seized and redirected malicious domains. The action was authorized by the U.S. District Court for the Southern District of Florida, resulting in the blocking of over 100,000 domains and the disabling of more than 20,000 accounts.
While the takedown disrupts the primary suppliers of phishing infrastructure, Microsoft noted that the action does not eliminate the wider phishing ecosystem. The company urged organizations to strengthen their phishing detection and identity protections to mitigate remaining risks.
