Microsoft Disrupts Phishing Network Behind 1B Messages

Microsoft and Health-ISAC have taken down parts of a Chinese-language phishing marketplace that, according to SecurityWeek, helped criminals send more than one billion malicious messages since January 2026. This matters at home because many of the US lures copied transportation and government agencies, including traffic and parking fee notices, the kind of texts and emails people may rush to pay.

What happened

According to SecurityWeek, Microsoft and Health-ISAC used a federal court order from the US District Court for the Southern District of Florida to seize and redirect domains tied to YAM Store, CoGUI and Iron Man.

Microsoft said the services supported phishing kits, accounts and infrastructure used by criminals. SecurityWeek reported that the messages targeted consumers and more than 75,000 organizations in over 150 countries, with more than 750 million aimed at Microsoft customers.

The same report says Microsoft disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. The investigation began after Japan’s National Police Agency alerted Microsoft in late 2025 about malicious messaging campaigns, and other security companies and law enforcement later joined the effort.

SecurityWeek says Iron Man includes thousands of templates for many countries. For the US, the most common lures impersonated transportation and government entities, including authorities tied to traffic and parking fees. The kits were built to collect login details and could prompt victims for one-time verification codes in real time.

Who is affected

The source does not list specific victims, phone numbers or email addresses. It also does not say that every Microsoft customer received one of these messages.

US households should treat this as a warning about fake fee, ticket, toll, parking and government-payment messages. A takedown can make a criminal service harder to use, but it does not remove every copycat site, old message or similar scam already in circulation.

Anyone who entered a password, card number or one-time code after following a link from a suspicious message should act quickly, especially if the page claimed to be Microsoft, a government agency, a transportation office or a payment portal.

What to do now

1. Do not pay a ticket, toll or parking notice from a text link. Open a browser yourself and type the official agency web address, or use the phone number printed on a paper notice you already received.

2. If a message says your Microsoft account needs action, go directly to account.microsoft.com or open the Microsoft app yourself. Do not sign in from a link in the message.

3. If you typed a password into a suspicious page, change that password from the real site immediately. If you reused it anywhere else, change it there too.

4. Turn on phishing-resistant sign-in where supported, such as passkeys or a hardware security key. One-time codes can be tricked out of people in real time, according to SecurityWeek’s description of the phishing kits.

   Yubico Security Key C NFC · 8.9/10 · list $29 See today's price on Amazon for Yubico Security Key C NFC
   A hardware security key fits this risk because it can stop many fake login pages from accepting a stolen sign-in attempt.

5. Use a password manager so each account has a different password. That limits the damage if one fake site captures one login.

   Bitwarden Premium · 9/10 · list $19.80 See today's price at bitwarden.com for Bitwarden Premium
   A password manager also helps because it will not autofill on many lookalike domains.

6. Report suspicious toll, package or fee messages as spam, then delete them. For more examples of this scam style, see CyberSec24’s guide to QR code, toll-text and package scams.