Phishing · Threat Intelligence
Global police disrupt network behind 1 billion phishing messages
A major law enforcement operation has disrupted a cybercrime network that sent over a billion phishing messages to targets in 150 countries, according to BleepingComputer.
Ross Grant3 min read
The short version
A global police operation has disrupted a huge cybercrime network that sent over a billion fake emails and texts to trick people into giving up their passwords or payment details. The criminals used advanced tools to make their scams look real and targeted organisations in 150 countries. Microsoft and Japanese police helped lead the investigation. It is not yet clear if any arrests have been made or how many people were affected.
By the numbers
- 1 billion+phishing messages sent by the disrupted networkBleepingComputer
- 75,000+organisations targeted worldwideBleepingComputer
- 150countries affected by the phishing operationBleepingComputer
- 20,000+accounts deactivated by MicrosoftBleepingComputer
- 100,000domains blocked for impersonation and fraudBleepingComputer
- 17,000+domains used by phishing kitsBleepingComputer
What happened?
Law enforcement agencies and partners worldwide have disrupted a cybercriminal network behind more than a billion phishing messages. The operation targeted over 75,000 organisations in 150 countries. The takedown followed an investigation led by Microsoft and Japan’s National Police Agency, according to BleepingComputer.
A global crackdown on phishing
According to BleepingComputer (opens in a new tab), law enforcement agencies and partners worldwide have disrupted a massive cybercriminal operation responsible for sending more than one billion phishing messages. The network targeted over 75,000 organisations across 150 countries. The takedown followed an investigation led by Microsoft and Japan’s National Police Agency, which uncovered a sprawling Chinese-language cybercrime marketplace called YAM Store (also known as Storm-3119).
How the phishing operation worked
YAM Store sold access to compromised or fraudulently obtained Microsoft and Google accounts, cloud licences, and storage. The operators used several tactics to make their scams more convincing. They acquired expired domains from real organisations, rebuilt their websites to appear active, and used these identities to register new cloud accounts. They also created fake organisations using AI tools to generate content and documentation.
Once inside compromised Microsoft environments, attackers used stolen credentials to manage accounts and licences. They abused Microsoft SharePoint and OneDrive to host phishing content. The phishing kits offered to criminals included lures such as fake unpaid tolls, traffic penalties, delivery problems, and account verification requests. These kits had advanced features like geofencing (targeting victims in specific locations), fake CAPTCHA gates, and IP filtering to evade detection by security teams.
The scale and tools of the operation
Microsoft said that the network delivered more than 750 million malicious messages to Microsoft 365 customers alone. The phishing campaigns often used device-code phishing, a technique to steal authentication tokens. The operation involved at least three major phishing kits: CoGUI, Haozi, and Iron Man System (collectively tracked as Storm-2990). The Iron Man kit alone offered over 2,300 templates impersonating banks, retailers, delivery services, and government agencies, and was used in 130 countries.
Researchers found more than 17,000 domains used for phishing by these kits. A publicly exposed registry linked to Iron Man contained 911 published builds and eight registered accounts. Updates to the phishing kits continued as recently as October 2026.
What action was taken
Under a court order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI, and Iron Man. Microsoft also deactivated over 20,000 accounts associated with YAM Store and blocked 100,000 domains used for impersonation and fraud. The investigation is ongoing, with more infrastructure being removed. The operation involved several partners, including Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
What you should do
Phishing remains a major threat to individuals and organisations. Even with large-scale takedowns, attackers are likely to adapt. Be cautious with unexpected emails or texts, especially those asking for personal information or account details. Use multi-factor authentication (MFA) where possible, and report suspicious messages to your IT or security team. Regular training and awareness are key to reducing the risk of falling victim to phishing scams.
Uncertainties
This story is currently based on a single report from BleepingComputer. There is no confirmation yet from Microsoft, law enforcement, or other primary sources. Details about arrests, specific countries most affected, or the full impact on victims are not yet clear.
Claimed vs confirmed
- Unconfirmed
A global cybercrime network sent over 1 billion phishing messages.
Reported by BleepingComputer. No confirmation yet from primary sources.
- Unconfirmed
Microsoft and Japanese police led the investigation and takedown.
Reported by BleepingComputer. No official statement from Microsoft or law enforcement yet.
The impact
- Money
- No financial losses or fines have been reported. However, under GDPR, organisations affected by data breaches could face fines up to €20 million or 4% of global turnover.
- Reputation
- The takedown may improve trust in law enforcement's ability to disrupt cybercrime, but the scale of the operation shows how organised phishing has become.
- Customers
- Anyone with an email or phone could be targeted by phishing. People should stay alert for suspicious messages and use multi-factor authentication where possible.
Why it matters
Phishing is one of the most common ways criminals steal personal and business information. This network targeted tens of thousands of organisations worldwide, showing how large and organised these attacks can be. Even after a big takedown, phishing remains a daily threat for everyone with an email or phone.
How does it work?
The network used phishing kits sold on underground marketplaces. These kits allowed criminals to send convincing fake messages, often using stolen or fake cloud accounts and domains. Some kits used advanced techniques like geofencing and fake CAPTCHAs to avoid detection. Attackers often stole credentials by tricking victims into entering details on fake websites.
Key points
- A global cybercrime network sent over 1 billion phishing messages before being disrupted.
- The operation targeted 75,000+ organisations in 150 countries.
- Attackers used advanced phishing kits and fake cloud accounts to trick victims.
- Microsoft and Japanese police led the investigation, with support from several partners.
- Phishing remains a major risk even after large-scale takedowns.
Sources
BleepingComputer
Reference
