GoKawiilMicrosoft and Japan's NPA dismantle Chinese phishing network behind 1B messages
Microsoft and Japan's National Police Agency disrupted a cybercrime ecosystem that sent over a billion phishing messages to more than 75,000 organizations in 150 countries, including over 750 million targeting Microsoft customers this year. The investigation traced the activity to a marketplace called YAM Store, linked to phishing kits CoGUI, Haozi and Iron Man System, which sold compromised Microsoft and Google accounts and hijacked domains to impersonate real organizations.
GoKawiil's interpretation of the reporting above, not reported fact.
The scale of the operation, spanning tens of thousands of organizations worldwide, illustrates how phishing-as-a-service infrastructure has industrialized cybercrime, letting less-skilled actors run sophisticated campaigns with ready-made evasion tools. Microsoft's disclosure of the kits' CAPTCHA-bypass and geofencing features suggests law enforcement is increasingly targeting the underlying marketplaces rather than individual phishing campaigns, which could disrupt multiple criminal operations at once.
- Over 1 billion phishing messages targeting 75,000+ organizations in 150 countries were linked to the disrupted network.
- The marketplace YAM Store sold compromised Microsoft and Google accounts, often using rebuilt defunct domains or AI-generated fake organizations.
- Phishing kits CoGUI, Haozi and Iron Man System offered thousands of templates and anti-detection tools like geofencing and fake CAPTCHAs.
YubiKey 5 Series Security Key — With phishing kits now mass-producing fake login pages at industrial scale, passwords alone aren't enough. A hardware security key like the YubiKey adds a physical authentication factor that these phishing campaigns simply can't replicate, protecting your Microsoft, Google, and other accounts even if credentials are stolen.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-14
Published there as: “Global takedown hits network behind 1 billion phishing messages”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.