Law enforcement agencies and partners worldwide have dismantled a large cybercriminal network responsible for over one billion phishing messages targeting more than 75,000 organizations in 150 countries. The operation involved the YAM Store marketplace and phishing kits CoGUI, Haozi, and Iron Man, which exploited compromised Microsoft and Google accounts and employed sophisticated tactics like AI-generated fake organizations and geofencing to evade detection. Microsoft and collaborators seized domains, disabled accounts, and blocked malicious infrastructure to disrupt the campaign, which had particularly targeted Microsoft 365 customers with device-code phishing to steal authentication tokens.
Global Takedown Hits Network Behind 1 Billion Phishing Messages
