Microsoft and partners disrupt phishing network tied to YAM Store, CoGUI and others
The takedown cuts off domains and accounts used to steal authentication tokens and run impersonation campaigns.
Microsoft and its partners have disrupted a phishing ecosystem tied to YAM Store, CoGUI, Haozi, and Iron Man System that sent more than 750 million malicious messages at Microsoft customers this year. The operation spanned more than 75,000 organizations in 150 countries, and Microsoft says the campaigns used device-code phishing to obtain authentication tokens. Under a U.S. court order, Microsoft and Health-ISAC seized and redirected domains linked to YAM Store, CoGUI, and Iron Man. Microsoft also disabled more than 20,000 accounts tied to YAM Store and blocked 100,000 domains used for impersonation and fraud. The investigation involved Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
Why it matters
People targeted by these campaigns should see fewer phishing lures coming from the disrupted infrastructure, and the operators lose the domains and accounts that made the scam scalable. The investigation also shows how stopping this kind of abuse now depends on court action and coordination across security firms and authorities.
Keep or strike?
Does this story matter, or is it hype? Mark it before you see what everyone else did.
Sources
- BleepingComputer