October 16th 2026, 3:20 PM
Microsoft Cracks Down on Phishing Network Funded by USDT
Key Summary
Microsoft has disrupted a phishing network that accepted USDT payments and targeted over 75,000 organizations worldwide, generating tens of millions of dollars for its operators. The company has seized domains and blocked thousands of impersonation and fraud domains, and is working with law enforcement to limit the network's ability to replace seized domains and compromised accounts.
Please see our real time news feed on our Home Page
Background and Context of the Investigation
The investigation into the phishing network was sparked by a tip from Japan's National Police Agency, which alerted Microsoft to scams targeting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could purchase the infrastructure needed to run phishing operations without building it themselves.The Role of YAM Store, CoGUI, and Iron Man in the Phishing Network
YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting. CoGUI and Iron Man supplied ready-made phishing pages and messages that mimicked banks, retailers, transport authorities, and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates, allowing customers to tailor scams to brands and countries.Payment Options and Blockchain Analytics
The payment options given to customers allowed them to buy compromised credentials and phishing services using multiple channels, including USDT on the Tron network and USDC. Blockchain analytics firm TRM Labs said its intelligence helped investigators locate assets linked to the group and freeze them.The Enforcement Effort
The enforcement effort involved Japan's police and Cybercrime Control Center, along with Oracle, Proofpoint, Resecurity, and US law-enforcement partners. Microsoft said the targeted suppliers were part of a larger criminal network, with related infrastructure still being removed. Cloudflare said it suspended accounts, disabled Workers projects supporting phishing pages, and banned hundreds of associated domains and projects.Limiting the Network's Ability to Replace Seized Domains and Compromised Accounts
Cloudflare said some domain registrars operate in jurisdictions that make legal seizures difficult, so it must block access through security warnings even as those domains remain online. Microsoft said the next challenge is limiting how quickly suppliers can replace seized domains and compromised accounts.#USDT#US#Crypto#Phishing