[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHZuSYbrdgqoKcEdnczw6n8lvjTbMj8tuP-1JGGbCx_g":3},{"article":4,"iocs":49,"watch_terms":61,"solutions":62,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"90c131d6-a619-48c1-ac1a-4d31c650de95","Global takedown hits network behind 1 billion phishing messages","global-takedown-hits-network-behind-1-billion-phishing-messages-d21e2d","A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]","Law enforcement and partners worldwide have disrupted a large cybercriminal ecosystem responsible for over a billion phishing messages targeting 75,000 organizations. The operation, initiated by Microsoft and Japan's NPA, identified the YAM Store marketplace and linked it to phishing kits like CoGUI, Haozi, and Iron Man System. These kits facilitated credential theft and fraud by impersonating legitimate organizations and using compromised accounts and AI-generated content.","Global takedown disrupts cybercrime network behind 1 billion phishing messages.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fglobal-takedown-hits-network-behind-1-billion-phishing-messages\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F14\u002Fphishing.jpg","2026-10-14T13:12:52+00:00","2026-10-14T14:00:19.485493+00:00",8,[17,20,23,25],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Storm-3119","threat_actor",{"name":24,"type":22},"Storm-2990",{"name":26,"type":27},"Microsoft 365","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[50,53,55,57,59],{"type":43,"value":51,"context":52},"CoGUI","Phishing kit used in the operation",{"type":43,"value":54,"context":52},"Haozi",{"type":43,"value":56,"context":52},"Iron Man System",{"type":43,"value":21,"context":58},"Tracking identifier for YAM Store",{"type":43,"value":24,"context":60},"Tracking identifier for CoGUI, Haozi, and Iron Man System",[18,26],{"controls":63,"vendors":148},[64,92,119],{"slug":65,"name":66,"problem":67,"products":68},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[69,77,84],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":18,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":93,"name":94,"problem":95,"products":96},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[97,103,111],{"vendor_slug":98,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":98,"url":101,"description":102},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[149,155],{"slug":150,"name":151,"logo_path":152,"roles":153},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[154],"affected",{"slug":78,"name":18,"logo_path":79,"roles":156},[154,157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":175},"billion-message-phishing-network-dismantled-lessons-in-credential-theft-at-scale","Billion-Message Phishing Network Dismantled: Lessons in Credential Theft at Scale","The YAM Store marketplace enabled cybercriminals to purchase ready-made phishing kits, dramatically lowering the barrier to entry for large-scale credential theft campaigns. By impersonating trusted organizations and leveraging AI-generated content, attackers bypassed traditional email filters and deceived users across 75,000 organizations worldwide. The use of compromised accounts to distribute phishing messages compounded the damage, as malicious emails originated from legitimately trusted senders. This case illustrates that phishing-as-a-service ecosystems can industrialize fraud to a scale that overwhelms reactive defenses, making proactive user education and technical controls essential.",[163,164,165,166,167,168,169,170,171,172,173,174],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IR-6 – Incident Reporting","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","NIST Cybersecurity Framework – Detect (DE.CM-1)","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of a Personal Data Breach","ITIL 4 – Incident Management Practice","RFC 7489 – DMARC (Domain-based Message Authentication, Reporting & Conformance)",{}]