Microsoft Dismantles Global Phishing Network Behind Billion Fake Messages
Microsoft has successfully concluded an operation to dismantle a global cybercriminal network. Primarily operating within Chinese-speaking digital spaces, the network provided fraudsters with the necessary infrastructure to conduct large-scale phishing campaigns, aimed at stealing sensitive user data. Investigations revealed that over one billion suspicious messages were sent using this infrastructure this year alone.## How the Cybercrime Market Operated
The operation began following intelligence provided by Japanese police regarding a rise in local fraud cases. Microsoft security experts uncovered an underground marketplace known as the YAM Store. This platform supplied criminals with stolen Google and Microsoft accounts, as well as specialized software such as CoGUI and Iron Man.
CoGUI served as a website-building framework that allowed criminals to easily replicate the appearance of banks, government agencies, and other trusted organizations. This tool was later replaced by Iron Man, a more sophisticated version offering over 2,300 ready-made templates. These templates mimicked the identities of retailers, law enforcement agencies, and healthcare providers across more than 150 countries.
Large-Scale Operation and Results
The popularity of these tools was such that their operators generated tens of millions of dollars in profit. According to Microsoft, their own users received more than 750 million phishing messages this year. In total, the attacks affected approximately 75,000 organizations worldwide.
Legal action was swift: following a US court order, Microsoft and its partners, including Health-ISAC, took down domains linked to the YAM Store, CoGUI, and Iron Man. Simultaneously, more than 20,000 accounts utilizing this network were terminated. In total, over 100,000 domains used for fraudulent activities have been blocked.
Why This Matters
While dismantling this specific infrastructure is a significant success, cybersecurity experts remain cautious. Such marketplaces often rebrand and continue operations if the primary offenders are not prosecuted. For example, when platforms like Cracked and Nulled were shut down in 2025, law enforcement arrested several individuals; however, the nature of cybercrime is such that new platforms constantly emerge.
For users, this case serves as a reminder that any unexpected message from a bank or government agency requesting that you click a link requires extreme caution. Cybercriminals currently employ such sophisticated templates that distinguishing a fake website from the original is often nearly impossible to the naked eye.