Microsoft Dismantles Phishing Network Accepting USDT Payments

Microsoft has dismantled a network of cybercrime tool providers that used stablecoins to fund phishing operations on a global scale. Legal action allowed for the seizure of domains associated with the YAM Store, CoGUI, and Iron Man services. These platforms facilitated the delivery of over one billion fraudulent messages this year.

The criminal services sold compromised cloud accounts and ready-to-use templates for fake websites. The investigation revealed that operators accepted payments in USDT on the Tron network along with other cryptocurrencies. The scheme allowed fraudsters to purchase pre-built infrastructure to attack companies and consumers without requiring advanced technical knowledge.

More than 75,000 organizations in 150 countries have been targeted by these campaigns since January. Criminals used expired domains from educational and non-profit institutions to lend legitimacy to their attacks. Microsoft disabled over 20,000 accounts linked to these activities and continues to block more than 100,000 domains used for spoofing.

The operation began following an alert from the National Police Agency of Japan regarding scams targeting companies and citizens. The criminal structure functioned as a self-service marketplace where groups bought everything from stolen credentials to hosting resources. The use of digital assets allowed for fast and global transactions between suppliers and buyers of fraud tools.

The exposure of criminal networks using stablecoins to fund illicit activities increases regulatory risk for the digital asset sector and may pressure authorities for greater oversight of cross-border transactions.