BTC$81,463
ETH$2,438
BNB$724.41
XRP$1.31
SOL$104.31
TRX$0.3342
HYPE$79.09
ZEC$1,182
DOGE$0.0808
XMR$554.26Microsoft Takes Down USDT Phishing Network That Hit 75,000 Firms
Microsoft dismantled a USDT-funded phishing network targeting 75,000 organizations across 150+ countries — over 1B malicious messages since January 2026.
Microsoft on October 14, 2026 disclosed a joint takedown with Japan's law enforcement against three interconnected phishing services — YAM Store, CoGUI, and Iron Man — that collectively sent more than 1 billion phishing emails and SMS messages to over 75,000 organizations across 150+ countries since January 2026. Operators used USDT on the Tron network (TRC20) to settle payments within the criminal infrastructure.
Details
At the center of the operation was YAM Store (tracked by Microsoft as Storm-3119), a marketplace reselling compromised Microsoft and Google accounts, cloud environments, and hosting. Payment was accepted in USDT (TRC20), Ethereum, Alipay, and WeChat Pay. Alongside it ran phishing kit suppliers CoGUI and Iron Man System (Storm-2990), the latter introduced through YAM Store in June 2026 as a phishing-as-a-service platform with 2,335 templates impersonating banks, retailers, and government agencies across 139 countries.
The investigation began in late 2025 when Japan's National Police Agency and Cybercrime Control Center (JC3) alerted Microsoft to campaigns targeting Japanese organizations. On October 14, 2026, the U.S. District Court for the Southern District of Florida issued an order enabling Microsoft to disable 20,000+ YAM Store accounts and block 100,000+ fraudulent domains. TRM Labs froze associated cryptocurrency assets; Cloudflare suspended accounts and disabled the network's domain infrastructure.
What This Means for the Market
The case marks the largest publicly documented law enforcement action against USDT-funded phishing infrastructure. "What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world," said Steven Masada, Microsoft Associate General Counsel. The scale of stablecoin use in cybercrime is increasing regulatory pressure on issuers — particularly Tether — to expand on-chain address blocking. TRM Labs' asset freezes in this operation reinforce the growing role of blockchain analytics firms in cross-border enforcement. For live market data, see CoinLab's daily digest.
Comments