Microsoft Just Took Down a Massive Phishing Network That Took Payments in USDT
Oct 17, 2026
Microsoft and Health-ISAC obtained a court order to seize domains behind a phishing operation that sent over a billion scam messages and accepted USDT from its customers.
A Billion Phishing Messages, One Court Order
Microsoft just teamed up with the cybersecurity group Health-ISAC to shut down a phishing-as-a-service operation that had been running wild since January. The two obtained a U.S. court order to seize and redirect domains tied to three toolkits known as YAM Store, CoGUI, and Iron Man.
These weren't small-time scams. According to researchers at ChainCatcher, the services allegedly helped criminals send more than 1 billion phishing messages, hitting organizations in over 150 countries and pulling in tens of millions of dollars for the people running them.
Why Crypto Keeps Showing Up Here
What stands out for the crypto crowd is the payment method: the toolkits reportedly accepted USDT from buyers looking to rent phishing infrastructure. It's another reminder that stablecoins, while useful for legit trading and payments, remain a favorite tool for bad actors who want fast, borderless transactions.
Takedowns like this won't end phishing overnight, but they do raise the cost of doing business for the people behind it.