Microsoft and Japan Police Dismantle Global Phishing Syndicate

Since January 2026, the illicit network enabled a massive wave of credential theft, specifically targeting 750 million Microsoft customers with deceptive alerts regarding fake packages and parking violations. Operators generated tens of millions of dollars by hijacking expired web domains and selling fraudulent accounts to lower-level scammers. The Iron Man platform alone provided over 2,300 templates, allowing criminals to convincingly impersonate banks, law enforcement, and healthcare institutions.

Microsoft responded by disabling 20,000 compromised accounts and blocking 100,000 web domains used for impersonation. Working alongside the cybersecurity non-profit Health-ISAC, the company seized and redirected the infrastructure powering the three platforms, effectively forcing the marketplace offline and disrupting the supply chain for global phishing campaigns.