Microsoft and Health-ISAC Dismantle Phishing Network That Took Payment in USDT and ETH

Microsoft and the healthcare-sector threat intelligence group Health-ISAC have obtained a US court order to seize and redirect domains linked to three phishing-as-a-service operations known as YAM Store, CoGUI and Iron Man. The networks are accused of sending more than one billion malicious messages and targeting over 75,000 organisations across more than 150 countries, with payment for their criminal infrastructure accepted in cryptocurrency alongside traditional methods.

For a European audience increasingly reliant on digital payment rails and cloud services, the case illustrates how stablecoins have become a routine settlement tool in cybercrime marketplaces, not just a speculative asset.

How the operations worked

YAM Store sold illicitly obtained Microsoft and Google accounts along with hosting and cloud infrastructure services, relying on a network of resellers to widen distribution. Some operators behind the service used expired domains belonging to educational institutions and nonprofit organisations to acquire and resell Microsoft 365 accounts. CoGUI and Iron Man, meanwhile, built pages and messages impersonating banks, retailers, transport authorities and government agencies. Microsoft and the security firm Resecurity identified more than 2,300 templates associated with Iron Man alone.

Microsoft disabled more than 20,000 accounts linked to YAM Store as part of the action and said it continues to block more than 100,000 domains used for impersonation and fraud across its platforms.

Crypto as the preferred settlement method

According to the investigation, YAM Store accepted USDT via the Tron network, as well as Alipay and WeChat Pay. Cloudflare noted that buyers of related criminal infrastructure could also pay with USDC, the stablecoin issued by Circle, while Microsoft's own analysis identified ether among the assets accepted by the networks. The disclosed information does not specify what proportion of transactions were settled in each asset.

The blockchain intelligence firm TRM Labs said it assisted investigators in locating and freezing assets connected to the group, though it did not disclose the value of the funds frozen.

Origins of the investigation

The inquiry began after Japan's National Police Agency alerted Microsoft to scams targeting consumers and businesses. Investigators later traced part of the activity to a Chinese-language marketplace that facilitated the purchase of resources used in fraudulent campaigns.

Cloudflare, which was involved in parts of the technical response, noted that some domain registrars used by the operators are based in jurisdictions where judicial seizure orders are difficult to enforce, a factor that has complicated similar takedown efforts in the past.