Microsoft collaborates with multiple parties to dismantle a phishing network accepting USDT payments, involving over 75,000 institutions

According to CryptoSlate, Microsoft and the cybersecurity organization Health-ISAC have obtained a court order in the United States to seize and redirect the domains supporting three services: YAM Store, CoGUI, and Iron Man. These three services sell stolen accounts and phishing tools to fraudsters. Since January of this year, they have assisted in sending over 1 billion phishing messages, targeting more than 75,000 institutions across over 150 countries, generating tens of millions of dollars in revenue for the operators.

Microsoft has disabled over 20,000 accounts associated with YAM Store and continues to block more than 100,000 counterfeit and fraudulent domains. According to Microsoft's investigation, these services accept payments in USDT (Tron network) and ETH, and Cloudflare stated that buyers can also use USDC for payments. Blockchain analytics company TRM Labs assisted investigators in locating and freezing related assets, but the amount frozen has not been disclosed.