Criminal suppliers accepted stablecoin payments for compromised cloud accounts and phishing tools, prompting a coordinated infrastructure and financial crackdown.
Microsoft disrupted cryptocurrency-accepting cybercrime suppliers linked to more than one billion phishing messages worldwide this year.
The company and cybersecurity group Health-ISAC secured a US court order to seize and redirect domains supporting YAM Store, CoGUI and Iron Man, three services that sold accounts and phishing tools to fraudsters, according to an Oct. 14 statement.
Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and was continuing to block more than 100,000 impersonation and fraud domains. Since January, the services helped criminals send messages targeting more than 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators.
The investigation began after Japan's National Police Agency alerted Microsoft to scams targeting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could purchase the infrastructure needed to run phishing operations without building it themselves.
YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations, then used the seemingly legitimate websites to obtain Microsoft 365 accounts for resale.
CoGUI and Iron Man supplied ready-made phishing pages and messages that mimicked banks, retailers, transport authorities, and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates, allowing customers to tailor scams to brands and countries.
Source link
