Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
Microsoft, Japan’s National Police Agency, and partners disrupted YAM Store (Storm-3119) and phishing kits CoGUI, Haozi, and Iron Man, tracked as Storm-2990. The ecosystem is linked to more than a billion malicious email and SMS messages aimed at over 75,000 organizations in 150 countries, including over 750 million messages to Microsoft customers, many using device-code phishing. Operators bought expired domains, built fake organizations with AI, and abused SharePoint and OneDrive. Under a Southern District of Florida order, Microsoft seized related domains, deactivated over 20,000 accounts, and blocked 100,000 impersonation domains.