Microsoft Maps a Phishing Supply Chain That Reached 75,000 Organizations

Microsoft says a network of phishing suppliers sent more than one billion malicious emails and text messages to over 75,000 organizations worldwide from January through mid-October 2026. The scale matters because the operation was not one criminal crew attacking one company. It was a supply chain that sold accounts, domains, templates and delivery infrastructure to many customers.

The company links three phishing kits, CoGUI, Haozi and Iron Man System, to a Chinese-language marketplace called YAM Store. Microsoft tracks the kit developers as Storm-2990 and the infrastructure broker as Storm-3119. Buyers could obtain fraudulently created or compromised Microsoft and Google accounts, then deploy templates that imitated banks, government agencies, logistics companies and other trusted brands. Microsoft says the businesses generated tens of millions of dollars, while accepting cryptocurrency including USDT and ether.

The investigation began after Japan's National Police Agency flagged malicious campaigns in late 2025. Microsoft later worked with Japanese authorities, cybersecurity companies and industry groups to connect what looked like separate scams. The company disabled more than 20,000 accounts and worked with partners to disrupt domains and payment flows. Those actions can raise costs for operators, but they do not erase the underlying market for reusable phishing infrastructure.

One qualification is essential: a brand appearing in a phishing template does not mean that brand's systems were breached. The 75,000 figure describes organizations targeted by messages, not 75,000 confirmed compromises. Microsoft also did not disclose a verified total for victim losses or the amount of cryptocurrency frozen.

For investors, the clearest consequence is operational rather than a direct earnings forecast. Cloud and security vendors increasingly have to investigate abuse that originates inside rented accounts and legitimate infrastructure. Payment issuers and stablecoin operators also face pressure to identify criminal flows without treating every crypto transfer as suspicious. The operation shows that cheap tooling can turn credential theft into a scalable service business, while disruption still depends on cooperation across platforms, law enforcement and blockchain analytics.