Microsoft and Partners Disrupt Phishing Network That Accepted USDT and Targeted 75,000 Organizations

Microsoft and cybersecurity group Health-ISAC obtained a U.S. court order to seize and redirect domains supporting YAM Store, CoGUI and Iron Man, services that sold stolen accounts and phishing tools to fraudsters. According to ChainCatcher, the services have helped send more than 1 billion phishing messages since January, targeting organizations in over 150 countries and generating tens of millions of dollars in revenue for their operators.Microsoft has disabled more than 20,000 accounts linked to YAM Store and continues to block over 100,000 spoofed and fraudulent domains. Microsoft’s investigation found that the services accepted USDT on the Tron network and ETH; Cloudflare said buyers could also pay with USDC. Blockchain analytics firm TRM Labs helped investigators locate and freeze related assets, but the amount frozen was not disclosed.