Global takedown hits network behind 1 billion phishing messages

A global law enforcement operation disrupted a large-scale phishing ecosystem responsible for over 1 billion malicious messages targeting more than 75,000 organizations across 150 countries. The infrastructure, linked to the Chinese-language marketplace YAM Store (Storm-3119), provided phishing kits such as CoGUI, Haozi, and Iron Man System (Storm-2990) that enabled cybercriminals to launch sophisticated campaigns using AI-generated fake organizations and compromised cloud environments. These kits delivered phishing messages via email and SMS, primarily targeting Microsoft 365 users, with lures including delivery issues, tolls, and account verifications, often bypassing MFA through device-code phishing. Microsoft, in collaboration with Japanese authorities, Resecurity, and other partners, seized domains, deactivated 20,000 accounts, and blocked 100,000 malicious domains to dismantle the network.

AI-extracted · verify before operational use