Global Takedown Hits Network Behind 1 Billion Phishing Messages
Law enforcement agencies and partners have disrupted a massive cybercriminal ecosystem that facilitated over 1 billion phishing messages targeting 75,000 organizations worldwide.
Intelligence analysis by Qwen 2.5 (3B)
Law enforcement has taken down a network responsible for sending over 1 billion phishing messages, targeting thousands of organizations globally.
Bad guys used a big network to send lots of fake messages to people's computers. Now the police stopped the network and took down the bad guys who were using it.
Analysis
YAM Store and its Role in the Ecosystem
The investigation revealed that YAM Store, an underground infrastructure marketplace, was the central hub for the phishing activities. YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licenses, and storage. Its operators used stolen application credentials to manage accounts and licenses, and abused SharePoint and OneDrive storage for hosting. The phishing kits offered cybercriminals a broad range of lures, including unpaid tolls, traffic penalties, delivery problems, and account verification requests. The kits supported geofencing, fake CAPTCHA gates, IP filtering, and other measures to obstruct security analysis.
Tools Overview
The phishing kits offered by YAM Store included CoGUI, Haozi, and Iron Man System phishing kits. CoGUI targeted victims in the United States and Japan, while Iron Man, which offered over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, pushed it aside by mid-2026. Iron Man admin panel was identified as a publicly exposed Git/container registry with 911 published builds and eight registered accounts. The researchers also identified a product-selection subsystem linked to payment-card capture, cataloging 2,360 phishing packages covering 130 countries/areas, with updates through October 1, 2026.
Disruption Efforts
Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man. The tech giant also deactivated over 20,000 accounts associated with the YAM Store and blocked 100,000 domains the cybercriminals used for impersonation and fraud. More infrastructure is being removed based on the findings of the investigation, which also involves the Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
Key points
- Law enforcement disrupted a network responsible for sending over 1 billion phishing messages.
- The network was used by YAM Store, an underground infrastructure marketplace.
- The phishing kits offered by YAM Store included CoGUI, Haozi, and Iron Man System.
- More than 20,000 accounts were deactivated and 100,000 domains were blocked.
- The disruption involved multiple organizations and countries.
This disruption could help prevent more people from getting tricked by fake messages, which could save them from losing money or having their personal information stolen.
Even though the network was taken down, there might be other bad guys who use similar methods to trick people. So we still need to be careful and stay safe.
