Microsoft Disrupts Three Phishing Scams Linked to More Than One Billion Fraudulent Messages
Microsoft and its partners have taken action against a major cybercrime network responsible for helping criminals send more than one billion fraudulent emails and text messages since January 2026. The messages targeted more than 75,000 organizations worldwide, including businesses, healthcare providers, and financial institutions. The operation focused on shutting down three phishing tools known as CoGUI, Haozi, and Iron Man System, which criminals used to trick people into sharing sensitive information and stealing money.
Phishing is a type of online scam in which criminals pretend to be trusted companies, banks, government agencies, or other organizations. They send fake emails or text messages designed to convince people to click a link, enter their passwords, or provide financial information. These messages often create a sense of urgency by claiming that a payment is overdue, an account needs attention, or an important document is waiting. The goal is to make victims act quickly without checking whether the message is genuine.
The three phishing tools targeted in the operation made it easier for criminals to carry out these scams on a large scale. Instead of building fake websites and scam messages themselves, attackers could purchase ready-made tools that did much of the work for them. The tools included templates that copied the appearance of legitimate websites and organizations, making fraudulent messages more convincing. Criminals could use these templates to target people in different countries and impersonate services such as banks, delivery companies, government agencies, and popular online platforms.
Investigators also uncovered an underground marketplace called YAM Store that helped supply the criminals with the resources needed to run their operations. The marketplace allegedly sold access to stolen or fraudulently created online accounts, cloud storage, and other digital services. Some of these resources were connected to Microsoft and Google platforms. By selling access to these accounts and services, the marketplace helped other criminals launch phishing campaigns without having to build their own infrastructure from scratch.
This arrangement allowed the criminal network to operate like a business, with different groups handling different parts of the operation. One group supplied the tools and online resources, while others used them to send scam messages and collect victims’ information. The criminals also used online storage services to host files and support their campaigns. This made it easier to manage large numbers of fraudulent websites and messages while making the activity harder to trace.
The impact of the operation extended across more than 150 countries, with consumers and organizations in industries such as healthcare, financial services, information technology, and wholesale distribution among the targets. Stolen information could be used to access victims’ accounts, impersonate legitimate users, or carry out financial fraud. In some cases, criminals could use stolen payment details to make unauthorized purchases or conduct fraudulent transactions. The scale of the activity shows how online scams can affect both individuals and large organizations.
Microsoft worked with several partners, including Health-ISAC, the Japan Cybercrime Control Center, and private cybersecurity companies, to disrupt the network. The coordinated effort targeted the infrastructure supporting the phishing tools and the underground marketplace, making it harder for criminals to access the services they relied on. The investigation began after researchers identified malicious messaging campaigns targeting people in Japan and later uncovered a much larger operation with international reach.
Although disrupting the network is an important step, it does not mean that every phishing threat has disappeared. Criminals may attempt to rebuild their services, switch to different tools, or use other platforms to continue their activities. People and organizations should therefore remain cautious when receiving unexpected emails or text messages, especially those demanding immediate payment or asking for login details.
To reduce the risk of becoming a victim, users should avoid clicking suspicious links and should never enter passwords or financial information through a link in an unexpected message. If a message claims to come from a bank, delivery company, or government agency, it is safer to visit the organization’s official website directly or contact it using a trusted phone number. Businesses should also train employees to recognize common scam tactics and provide a clear way to report suspicious messages.
The disruption of these three phishing tools highlights how organized cybercriminal networks are making online scams easier to carry out. By selling ready-made tools and access to online services, criminals can target large numbers of people without needing advanced technical skills. While the latest operation has disrupted important parts of this network, staying alert, verifying unexpected requests, and protecting account information remain essential steps in defending against phishing scams.
