{"id":572837,"date":"2026-10-16T16:20:01","date_gmt":"2026-10-16T15:20:01","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=572837"},"modified":"2026-10-16T12:40:48","modified_gmt":"2026-10-16T11:40:48","slug":"microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/","title":{"rendered":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations"},"content":{"rendered":"<p>Microsoft disrupted cryptocurrency-accepting cybercrime suppliers linked to more than one billion phishing messages worldwide this year.<\/p>\n<p>The company and cybersecurity group Health-ISAC secured a US court order to seize and redirect domains supporting YAM Store, CoGUI and Iron Man, three services that sold accounts and <a href=\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\">phishing tools<\/a> to fraudsters, according to an Oct. 14 <a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2026\/10\/14\/disrupting-the-service-economy-behind-transnational-cybercrime-operations\/\">statement<\/a>.<\/p>\n<p>Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and was continuing to block more than 100,000 impersonation and fraud domains. Since January, the services helped criminals send messages targeting more than 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators.<\/p>\n<p>The investigation began after Japan's National Police Agency alerted <a href=\"https:\/\/cryptoslate.com\/companies\/microsoft\/\">Microsoft<\/a> to scams targeting consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could purchase the infrastructure needed to run phishing operations without building it themselves.<\/p>\n<p>YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations, then used the seemingly legitimate websites to obtain Microsoft 365 accounts for resale.<\/p>\n<p><a href=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter shoggoth-infographic shoggoth-infographic-portrait wp-image-572838\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e.png\" alt=\"Supplier-flow diagram showing YAM Store cloud accounts and hosting, CoGUI and Iron Man phishing kits, court-backed domain action and more than 20,000 disabled accounts. USDT and ETH were among payment options; licensing evidence came from a lab test and TRM's freeze amount is undisclosed.\" width=\"720\" height=\"900\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e.png 1122w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e-240x300.png 240w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e-819x1024.png 819w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/exec-e5d7e417-9286-4436-be3b-192621e1e07e-768x960.png 768w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/a><\/p>\n<p>CoGUI and Iron Man supplied ready-made phishing pages and messages that mimicked banks, retailers, transport authorities, and government agencies. Microsoft and security firm Resecurity identified more than 2,300 Iron Man templates, allowing customers to tailor scams to brands and countries.<\/p>\n<h2>Crypto payments and a wider infrastructure crackdown<\/h2>\n<p>Microsoft's technical investigation <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/10\/14\/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime\/\">found<\/a> that the services accepted cryptocurrency, including <a href=\"https:\/\/cryptoslate.com\/coins\/tether\/\">Tether's USDT<\/a> and Ethereum. YAM Store's storefront supported USDT on the <a href=\"https:\/\/cryptoslate.com\/blockchain\/tron\/\">Tron<\/a> network alongside Alipay and WeChat Pay, while Cloudflare said buyers could also pay for marketplace offerings with <a href=\"https:\/\/cryptoslate.com\/coins\/usd-coin\/\">USDC<\/a>.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/coinbase-traced-1-1-million-crypto-trail-behind-ai-phishing-service-eviltokens\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">Coinbase traced $1.1 million crypto trail behind AI phishing service EvilTokens<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>The payment options gave customers multiple channels to buy compromised credentials and phishing services. YAM Store also maintained a sub-reseller tier, expanding the distribution of accounts and infrastructure beyond its own storefront.<\/p>\n<p>Blockchain analytics firm TRM Labs <a href=\"https:\/\/www.trmlabs.com\/resources\/blog\/trm-supports-takedown-of-chinese-language-cybercrime-ecosystem-with-microsoft-health-isac-and-others\">said<\/a> its intelligence helped investigators locate assets linked to the group and freeze them. The company did not specify the value of the frozen assets, leaving the operation's immediate financial damage unclear.<\/p>\n<p>The enforcement effort also targeted services criminals used after making their purchases. Cloudflare <a href=\"https:\/\/www.cloudflare.com\/threat-intelligence\/research\/report\/yam-store-closing-early\/\">said<\/a> it suspended accounts, disabled Workers projects supporting phishing pages, and banned hundreds of associated domains and projects. It placed warning pages in front of malicious links where it couldn't seize domains.<\/p>\n<p>Microsoft also identified a dependency in Iron Man's subscription business: customers bought access to <a href=\"https:\/\/cryptoslate.com\/crypto-phishing-scams-net-300-million-from-unsuspecting-investors-in-2023\/\">phishing software<\/a> connected to a vendor-controlled licensing server. Disabling that infrastructure could interfere with customers' ability to use purchased kits, even if copies remained in circulation.<\/p>\n<p>The crackdown involved Japan's police and Cybercrime Control Center, along with Oracle, Proofpoint, Resecurity, and US law-enforcement partners. Microsoft said the targeted suppliers were part of a larger criminal network, with related infrastructure still being removed.<\/p>\n<p>The next challenge is limiting how quickly suppliers can replace seized domains and compromised accounts. Cloudflare said some domain registrars operate in jurisdictions that make legal seizures difficult, so it must block access through security warnings even as those domains remain online.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Domain seizures and account shutdowns hit YAM Store and phishing-kit services, while reported asset freezes remain unquantified.<\/p>\n","protected":false},"author":720,"featured_media":572844,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76799,77968,32631],"tags":[76128,76890,72190,77040,76896,79772,72860],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations<\/title>\n<meta name=\"description\" content=\"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations\" \/>\n<meta property=\"og:description\" content=\"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-16T15:20:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-16T11:40:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/microsoft-phishing-crypto-takedown.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Oluwapelumi Adejumo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oluwapelumi Adejumo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person\",\"name\":\"Oluwapelumi Adejumo\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"jobTitle\":\"Senior Reporter\",\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/hardeyjumoh\",\"https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo\",\"https:\/\/muckrack.com\/oluwapelumi-adejumo\"]},\"headline\":\"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations\",\"datePublished\":\"2026-10-16T15:20:01+00:00\",\"dateModified\":\"2026-10-16T15:20:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\"},\"wordCount\":525,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"ETH\",\"Ether\",\"ethereum\",\"Microsoft\",\"Tether\",\"TRM Labs\",\"USDT\"],\"articleSection\":[\"Crime\",\"Featured\",\"Stablecoins\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\",\"url\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\",\"name\":\"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-10-16T15:20:01+00:00\",\"dateModified\":\"2026-10-16T15:20:01+00:00\",\"description\":\"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6\",\"name\":\"Oluwapelumi Adejumo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"jobTitle\":\"Reporter\",\"worksFor\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations","description":"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations","og_description":"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.","og_url":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/","og_site_name":"CryptoSlate","article_published_time":"2026-10-16T15:20:01+00:00","article_modified_time":"2026-10-16T11:40:48+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/microsoft-phishing-crypto-takedown.webp","type":"image\/webp"}],"author":"Oluwapelumi Adejumo","twitter_card":"summary_large_image","twitter_creator":"@cryptoslate","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Oluwapelumi Adejumo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person","name":"Oluwapelumi Adejumo","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-300x300.jpg","caption":"Oluwapelumi Adejumo"},"jobTitle":"Senior Reporter","description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/hardeyjumoh","https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo","https:\/\/muckrack.com\/oluwapelumi-adejumo"]},"headline":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations","datePublished":"2026-10-16T15:20:01+00:00","dateModified":"2026-10-16T15:20:01+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/"},"wordCount":525,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["ETH","Ether","ethereum","Microsoft","Tether","TRM Labs","USDT"],"articleSection":["Crime","Featured","Stablecoins"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/","url":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/","name":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-10-16T15:20:01+00:00","dateModified":"2026-10-16T15:20:01+00:00","description":"Microsoft targeted three cybercrime services selling phishing infrastructure for USDT and other payment methods in a global crackdown.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/microsoft-exposes-how-usdt-funded-phishing-network-targeted-75000-organizations\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Microsoft exposes how USDT-funded phishing network targeted 75,000 organizations"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/contact\/?topic=advertising#contact-form","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6","name":"Oluwapelumi Adejumo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/profile-oluwapelumi-adejumo-1-150x150.jpg","caption":"Oluwapelumi Adejumo"},"description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","jobTitle":"Reporter","worksFor":"CryptoSlate","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/572837"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/720"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=572837"}],"version-history":[{"count":3,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/572837\/revisions"}],"predecessor-version":[{"id":573019,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/572837\/revisions\/573019"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/572844"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=572837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=572837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=572837"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=572837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}