Microsoft Seizes Domain Control to Shut Down USDT‑Funded Phishing Network
Current overview (not historical)
Microsoft, in partnership with Health‑ISAC, obtained a U.S. court order to seize and redirect the domains of YAM Store, CoGUI, and Iron Man, effectively shutting down a phishing network that used USDT (Tether) for fund transfers. The action closed more than 20,000 accounts linked to the scheme, which had already impacted roughly 75,000 organizations. Following the initial seizure, Microsoft continued to block over 100,000 fraudulent domains, severing the network’s primary entry points. The coordinated effort demonstrates how Microsoft and industry security groups can leverage judicial tools to rapidly dismantle cross‑border scam operations, significantly reducing the threat to both enterprises and individuals.
Written with AI from the reporting · updated 10/16/2026
EventGraph Explorer
One time cutoff for reports, relations and evidence.
New at this step ·Microsoft Disrupts USDT-Linked Phishing Network Targeting 75,000 Orgs
- Reports in replay
- 1
- First-party
- 0
- Sources
- 1
Reports first seen at this step · 1
- CryptoSlate · Third-partyMicrosoft Disrupts USDT-Linked Phishing Network Targeting 75,000 OrgsOriginal source ↗
Discovery-time replay; the linked graph and evidence share this cutoff. The full overview and activity remain current.
Event developments
1 developments10/16/2026, 11:47:44 PM
Microsoft Disrupts USDT-Linked Phishing Network Targeting 75,000 OrgsCryptoSlate
Filtered by first discovery; only representative reports already discovered by this cutoff are shown. Story grouping may have changed later, so this is not a complete historical snapshot.
Relations at this time
Loading time-scoped relations…
Bounded reconstruction, not an exact snapshot: entity names, relationship text and story grouping may include later revisions. Overview and full source archive below remain current.
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Oct 16, 00:00recorded Oct 16, 23:47single sourcerevised
Microsoft disrupts USDT‑funded phishing network
Read original source ↗ CryptoSlateReplay this moment in the explorer
Uncertainty marks flag where to check the sources; they are not proven causation.
Full source archive (current)
Current public reports; outside the historical replay.
First-party sources · 0 reports
No verifiable reports in this group yet.
Independent coverage · 1 reports
- CryptoSlate · Oct 16, 23:20Microsoft Disrupts USDT-Linked Phishing Network Targeting 75,000 Orgs
Microsoft and Health-ISAC seized domains linked to YAM Store, CoGUI, and Iron Man, disabling over 20,000 accounts and blocking 100,000+ fraudulent domains. The network targeted 75,000 organizations globally, generating millions in revenue.
Read original source ↗
Different reports do not necessarily disagree. Check original sources and publication dates.
Report timeline
Explore every side through dated source reports.
- CryptoSlateSelectedMicrosoft Disrupts USDT-Linked Phishing Network Targeting 75,000 Orgs
Microsoft and Health-ISAC seized domains linked to YAM Store, CoGUI, and Iron Man, disabling over 20,000 accounts and blocking 100,000+ fraudulent domains. The network targeted 75,000 organizations globally, generating millions in revenue.