Kategorie

Microsoft says it has dismantled a criminal marketplace responsible for 1 billion malicious messages.

Working with international authorities and several tech and cybersecurity companies in a nearly year-long investigation, Redmond identified and took down Yam Store, a coordinated underground network dealing in commercial phishing-as-a-service (PhaaS).

The network allowed cybercriminals to readily purchase, and very quickly deploy, pre-made kits they could use in phishing attacks to steal data and credentials.

Microsoft said the takedown began as a simple investigation based on a tip from Japanese authorities.

“Working together, and with the assistance of AI tools, we connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them,” Steven Masada, associate general counsel and GM for Microsoft’s Digital Crimes Unit, wrote in a blog post. “What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”

The evolving PhaaS marketplace

Collectively, YAM Store and the kits and tools sold within it enabled the sending of more than 1 billion messages to 75,000-plus organizations worldwide. More than 750 million of those were sent to Microsoft customers alone, and ultimately generated “tens of millions of dollars” for criminal operators. 

Investigation into the marketplace began in late 2025 after Japan’s National Police Agency (NPA) notified Microsoft of “a wave of fraud and scam activity” targeting people and businesses in Japan. Researchers expected to find multiple individual campaigns; instead, they discovered a “sprawling Chinese-language cybercrime marketplace.” The probe expanded globally and involved the efforts of several other law enforcement agencies, as well as companies like Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

The YAM Store served as an initial access broker (IAB), operating much like an online marketplace; in this case, the merchandise was fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams like credential and data theft. Customers could browse, compare prices, and make purchases. Available tools were arranged based on age and subscription and environment types (like .edu or .org sites).

In some cases, criminal operators were able to register internet domains that legitimate organizations had allowed to expire, then rebuilt them to appear active. They targeted specific sectors (like non-profits or education) to fraudulently obtain Microsoft 365 accounts to later sell through the YAM store.

The researchers discovered that the YAM Store evolved as different kits became available, and identified three popular PhaaS kits: Iron Man System, CoGUI, and Haozi.

The newer Iron Man system came to the fore in mid-2026. It provided pre-built lure pages capturing any victim-submitted data. The lure sites impersonated healthcare providers, police departments, government agencies, postal and courier services, toll and transportation authorities, tax agencies, banks, telecoms, and retailers. Through test purchases and intelligence work, investigators discovered more than 2,300 templates impersonating organizations across more than 150 countries.

Iron Man effectively expanded the PhaaS model by giving criminals access to thousands of ready-made templates tailored to specific industries, languages, and regions. Masada noted that many “used the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”

The kits were also equipped with advanced evasion techniques such as geofencing, fake CAPTCHA gates, IP address blocklists and allowlists, and anti-detection configurations.

Masada emphasized that, while an organization or government entity may have been presented among the template offerings, it does not indicate that its systems were compromised.

However, members of the Microsoft Threat Intelligence and Microsoft Digital Crimes Unit wrote in a blog post, “the scale and proliferation of this ecosystem demonstrate how readily available criminal infrastructure can lower the barrier to entry, enabling less skilled cybercriminals to target organizations at scale and contribute to fraud losses.”

The importance of cyber hygiene

In nearly all observed cases, phishing lures presented “prescriptive scam red flags,” Microsoft researchers explained: Urgency and time-sensitive tasks.

They advised that users have a basic understanding of common phishing techniques and should be educated to always verify with the purported sender before clicking a link supposedly taking them to a login page, even when the task involves signing in to a known, secure account.

Beyond this, they said, sign-in prompts should clearly identify the application being authenticated to. In Microsoft Azure interactions since 2021, for example, users are prompted to “cancel” or “continue” at login, but this is often missing from phishing sign-ins, the researchers noted.

Hardening credentials and cloud identities is also necessary to defend against phishing attacks; the researchers suggested an initial step of passwordless tools like passkeys and multifactor authentication (MFA) across organizations.

“Invoke the principles of least privilege and zero trust to significantly slow down threat actors who might have been able to gain initial access and buy time for defenders to respond,” the researchers noted. These steps can help lock down global administrator roles in particular.

They also advised additional actions including the use of the Microsoft Authenticator app for passkeys and MFA; configuration of the Microsoft Defender for Office 365 Safe Links policy to apply to internal recipients; complementing MFA with conditional access policies; and only allowing MFA and passkey registrations from trusted locations and devices.

This article originally appeared on CSOonline.

Say a developer queues a build on a shared Linux host.

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

Let's Encrypt switched its staging service to 64-day certificates on October 14, 2026.

A developer clones a repository, changes into it, and opens Zellij.

Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybersecurity would have prevented it.

French authorities say the systems, made up of entire fleets of refrigerators and freezers throughout a store, were hacked. More specifically, Internet-connected controllers that allow technicians to remotely administer the store-wide systems were compromised. The unknown attackers responsible then activated defrosters long enough for the fridges to reach temperatures as high as 50° Celsius (122° Fahrenheit). By the time the mass compromise was discovered, food was spoiled, and in some cases their electrical systems caught fire.

The hacks that didn't have to happen

Multiple security advisories and public research reports show that all three of the controller models reportedly hacked in the incident—sold by Danfoss of Denmark and Dixell and its parent company Copeland in the US—contained critical vulnerabilities that allow attackers to remotely log in to the devices with the same system rights as administrators. Until recently, Danfoss controllers, for instance, used a credential that changes each day. The password is generated by the publicly available firmware based on the date. A hacker who takes the time to analyze the code can do the same thing on any device that hasn’t received a recent update. Daily passwords are identical across models located in hundreds or thousands of stores.

Read full article

Comments

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]

Linux creator Linus Torvalds has now begun using AI to write code for the operating system’s kernel. In a new coding project, he has used Anthropic’s AI tool, Claude Code, to develop eight code changes to resolve a performance issue in Linux, reports ZDNet.

“The code, the test programs, the review that forms the basis of the list above, and the first draft of this text were produced with the help of an LLM coding assistant (Claude Code) under my supervision,” Linus Torvalds writes in the documentation.

The changes are still experimental and have not been incorporated into the official Linux kernel.

Torvalds has previously been skeptical of AI-generated code but has gradually become more positive about the technology. During the Open Source Summit Europe conference in Prague, he recently shared that he has gained a new perspective on it.

“I used to think the technology just wasn’t very good. But now I’ve reached a point where I really enjoy using AI,” Linus Torvalds said at the time.

This article originally appeared on Computer Sweden.

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The European Commission has launched investigations into OpenAI and Anthropic after the companies’ AI agents escaped their test environments and infiltrated other organizations’ systems, Euronews reports.

In one case, an AI agent from OpenAI managed to break out of its test environment and hack the AI platform Hugging Face. In the other case, a model from Anthropic gained unauthorized access to the systems of three external organizations.

The EU’s AI Office has now requested additional information from the companies regarding, among other things, security procedures, external evaluations, and monitoring of AI models. The documents previously submitted by the companies are not considered sufficient.

These investigations will serve as a test for the EU’s AI regulation, the AI Act. Since August, the AI Office has had the authority to take action against companies that do not meet the law’s security requirements.

The legal situation is complicated, Euronews notes. The AI Act includes exemptions for research and development, and it is unclear whether the law can be applied to incidents that occur before a model is launched.

This article originally appeared on Computer Sweden.

Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Imagine releasing a software solution into the market only to realize the user cannot use the app properly. They have been reporting numerous bugs, which has lowered your reputation and reliability.

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Business email compromise has long involved targeted impersonation and fraudulent payment requests. Generative AI can make those established tactics faster to prepare and more convincingGenerative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it.

If you run Postfix, Exim, or OpenSMTPD on Linux, DKIM is already your problem. The private key lives on your box. If that key leaks or signing stops, your domain reputation moves without you.

You've probably trained your team to look for red flags. Odd sender names, urgent language, mismatched links. But a well-crafted spoofed email won't trip any of those wires. It looks legitimate, sounds legitimate, and often comes from a domain that passes every automated check you throw at it.

Template email is more than a design tool in the campaign of consistent communication; it also has a hidden danger.