A billion messages..... and the next one may be yours.

Microsoft says those figures cover the wider YAM Store, CoGUI and Iron Man criminal ecosystem since January 2026. They describe targeting, NOT 75,000 confirmed breaches.

Now Microsoft’s Digital Crimes Unit used a US court order to seize and redirect domains powering the operation. Microsoft also disabled more than 20,000 accounts connected to YAM Store and says it continues blocking over 100,000 domains used for impersonation and fraud.

This is phishing organised as a commercial service. Criminals could purchase accounts, infrastructure and ready-made tools rather than build everything themselves. Resecurity identified 2,360 Iron Man phishing templates impersonating couriers, banks, retailers and government agencies, with ongoing updates to both the software and the bait. Apparently, even the phishing industry understands continuous improvement.

A welcome disruption..... BUT it is not the end of phishing.

People remain on the receiving end of industrial-scale attacks, each trying to turn a familiar name, an unexpected bill or a delivery problem into a hurried decision.

Once again, the human remains the weakest link. A busy person expecting a parcel does not need to be particularly careless. The right message arriving at the wrong moment can be enough.

That is why security awareness needs training..... and repeated training. A once-off presentation and a completion certificate will not keep staff prepared as the attacks adapt. Make reporting easy and free from blame. Technical controls must support staff, because no training can make everyone spot every attack.

Microsoft and its partners like BUI can disrupt the infrastructure, but businesses still need to prepare the people receiving the next message.