Microsoft Took Down a Billion-Message Phishing Network. Now What?

Microsoft just seized the infrastructure behind more than a billion phishing messages. It's a genuine win — and also a reminder that, for the rest of us, the phishing problem hasn't gone anywhere.

On 14 October 2026, Microsoft's Digital Crimes Unit and Health-ISAC moved against three parts of a Chinese-language cybercrime marketplace: YAM Store, which sold fraudulent Microsoft and Google accounts; CoGUI, which churned out ready-made fake login pages; and Iron Man, a library of more than 2,300 brand-impersonation templates. Microsoft tracks the crew as Storm-2990. Since January, these services helped send over 1 billion malicious messages at more than 75,000 organisations across 150-plus countries, with over 750 million aimed squarely at Microsoft customers. A US court order let Microsoft seize the domains, disable 20,000-plus linked accounts, and block more than 100,000 fraud domains.

Don't file this under "overseas problem." Proofpoint, which fed threat data into the takedown, found Australian financial services and healthcare organisations were among the most-targeted sectors after Japan — ahead of government, education and manufacturing. The whole point of a marketplace like this is that it hands polished, convincing phishing to criminals with no skill of their own: the kind that drops a believable "your Microsoft 365 password is expiring" or "parcel held at the depot" email into your team's inbox. Australian SMBs get caught in that net whether or not they were ever the headline target.

Why a Takedown Isn't the End

Here's the uncomfortable bit. A takedown feels like the end of the story — it isn't. These operators rotate domains constantly, and the same kits tend to reappear under new names within days or weeks. We see it play out in client inboxes: a brand that was "taken down" is impersonating staff again by the end of the month. So the defence can't be waiting for the next raid. Two controls do almost all the heavy lifting — phishing-resistant multi-factor authentication, so a stolen password on its own is useless, and a team that's been trained to spot the lure and told exactly where to report it. Everything else is secondary to those two.

• Turn on phishing-resistant MFA. Use an authenticator app or hardware key — not SMS codes — on every account that will take it, starting with email and admin logins.
• Train your team, regularly. Short, real-world phishing examples beat an annual slideshow, and everyone should know the one place to report a suspicious email.
• Lock down Microsoft 365. These kits target M365 logins specifically; conditional access and impossible-travel alerts catch a stolen sign-in before it does damage.
• Know who's watching. Be clear on whether your team, your provider, or nobody at all is reviewing flagged emails and sign-in alerts.

Written by Michael Sacco, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across Australia, including the Northern Beaches, Central West NSW, Brisbane and Melbourne.