International Law Enforcement Dismantles Multimillion-Dollar Phishing Network

The Takedown of an Underground Phishing Engine

A coordinated operation led by Microsoft’s Digital Crimes Unit, Health-ISAC, and international law enforcement recently dismantled a massive Chinese-language phishing marketplace responsible for a staggering wave of global cyberattacks. At the center of the network was YAM Store, an underground illicit storefront, alongside specialized phishing-as-a-service kits known as CoGUI and Iron Man System. Since early 2026, this infrastructure enabled scammers to route over one billion malicious emails and SMS text messages targeting more than 75,000 organizations across 150 countries. The operators scaled their illicit business by taking over expired web domains, fabricating organizations using AI-generated content, and selling pre-configured access to compromised enterprise cloud tenants.

Neutralizing the Core Infrastructure

Court orders issued by the U.S. District Court for the Southern District of Florida allowed investigators to seize and sinkhole the domains that powered the marketplace and its automated phishing tools in order to destroy the network. Additionally, Microsoft blacklisted almost 100,000 domains that were being used as weapons for credential theft and impersonation, and terminated over 20,000 related accounts. Threat analysts acknowledge that decentralized cybercrime organizations swiftly try to switch to backup infrastructure, but eliminating the essential access broker and kit distribution methods severely undermines the supply chain and revenue model that these international scammers depend on.

Author Notes

Microsoft. “Disrupting the service economy behind transnational cybercrime operations.” Published October 14, 2026. https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/ 

About the Author

Carmen Estela is a Cybersecurity Research Analyst at Cyber Defense Magazine and a Women in Cybersecurity Award Candidate. She recently graduated with a Master of Science degree from the University of Central Florida and holds a Bachelor’s degree in Criminology from the University of Florida with certifications in Data Analytics and AI Fundamentals. She frequently speaks and volunteers at well-known industry gatherings, such as BSides Orlando and BSides Jax, where she offers her perspectives on emerging cyber trends. Carmen is committed to advancing the standards of governance, risk, and compliance within cybersecurity. She has also served as an adult protective investigator, police dispatcher, and legal intern, applying investigative skills across law enforcement, academic, and public service settings. 

Reach her online at [email protected].