Microsoft disrupts crypto-paid phishing supply network

Microsoft and Health-ISAC disclosed on October 14 that they had used a federal court order to seize and redirect domains supporting YAM Store and associated phishing-kit services. Microsoft’s threat researchers said the marketplace and affiliated vendors accepted cryptocurrency, including USDT and ether, for fraudulently obtained cloud accounts, phishing infrastructure and software subscriptions.

The development matters to the crypto industry because it documents digital assets as one payment option inside a broader cybercrime supply chain. It does not show that USDT or ether caused the phishing activity, establish how much cryptocurrency changed hands or identify the value of assets frozen during the operation.

A supplier network, not one phishing campaign

Microsoft describes YAM Store, tracked as Storm-3119, as an initial-access broker. It allegedly sold access to compromised or fraudulently created Microsoft and Google environments, including accounts, licenses and storage. CoGUI, Haozi and Iron Man System, tracked together as Storm-2990, supplied templates and tools that customers could use to impersonate banks, government bodies, health providers, retailers and transport services.

Microsoft said activity linked to the kits facilitated more than one billion phishing emails and text messages to more than 75,000 organizations from January 2026 through the October 14 disclosure. Its researchers counted more than 2,335 Iron Man templates tailored to more than 139 countries. Those figures come from Microsoft’s own telemetry and investigation; they measure messages, targeted organizations and discovered templates, not confirmed victims, successful compromises or financial losses.

The company said the services affected organizations in Japan, the United States, Australia and India, among other markets. Japan’s National Police Agency initially alerted Microsoft to malicious campaigns in late 2025, according to Microsoft. The inquiry later involved the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and blockchain-intelligence company TRM Labs.

USDT was one checkout rail

Microsoft’s technical report says YAM Store and affiliated phishing-kit companies accepted cryptocurrency, including USDT and ether. It gives the more precise detail that YAM Store’s storefront accepted USDT on Tron’s TRC-20 token standard alongside Alipay and WeChat Pay.

That mix is an important limitation. The evidence supports describing crypto as part of the payment infrastructure, not as the exclusive funding method. Microsoft disclosed no transaction count, wallet list, payment total or breakdown by asset. Coinburn therefore cannot calculate cryptocurrency’s share of marketplace revenue or connect the operators’ alleged tens of millions of dollars in proceeds to digital-asset payments alone.

TRM Labs said its intelligence helped locate and enable the freezing of assets associated with the group. TRM did not disclose the assets, chains, addresses, freeze date or value. A freeze also does not establish forfeiture, victim restitution or a final determination that every associated asset represented criminal proceeds.

Temporary relief, not a final judgment

Microsoft’s published court notice identifies the case as Microsoft and Health-ISAC v. Yang Jian, doing business as Yam Store, and unnamed defendants in the U.S. District Court for the Southern District of Florida. It says Microsoft obtained a temporary restraining order and sought preliminary and permanent relief.

The notice says the requested measures include transferring domains to Microsoft’s control or disabling them while preserving associated material. Microsoft separately reported disabling more than 20,000 accounts connected to YAM Store and blocking more than 100,000 domains used for impersonation and fraud as of October 14.

Those are disruption measures, not a final adjudication of liability. The public notice describes Microsoft’s allegations, and the temporary order does not resolve the merits. It also does not prove the wider ecosystem has been eliminated: Microsoft and TRM both describe the targeted services as parts of a larger network.

Coinburn is publishing this follow-up on October 16. The next verifiable milestones are any response from the defendants, a public preliminary-injunction ruling, disclosed forfeiture proceedings or attributable blockchain records showing what was frozen. Until then, the strongest conclusion is narrow: investigators disrupted infrastructure for a phishing supply network that offered USDT and ether among its payment methods, while the financial scale of the crypto activity remains undisclosed.