That unpaid-toll text came from a phishing kit with a live scammer at the controls. Microsoft just pulled the plug on three of them.

You owe $3.95 for a toll you don’t remember. Or a parcel is stuck because the address was “incomplete”. Or there’s a traffic fine, payable today, via a link. You’ve had one of these texts. Everybody has. On October 14, Microsoft’s Digital Crimes Unit, Japan’s National Police Agency and Health-ISAC announced  they’d taken down three of the services that write them: YAM Store, CoGUI and Iron Man. A court order from the Southern District of Florida let them seize and redirect the domains behind all three

The numbers are silly. Since January, Microsoft says, these services were behind “more than one billion malicious messages” targeting over 75,000 organizations in more than 150 countries, 750 million of them aimed at Microsoft’s own customers, and worth “tens of millions of dollars” to the people running them. For $3.95 at a time, apparently. Volume is a business model 🤑

A phishing shop with a catalogue

None of this is one gang typing texts by hand. It’s a supply chain, and Microsoft’s threat intelligence write-up  lays it out. YAM Store is the shop. Among other things it “hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts”, using automation to find expired organisation names it can take over. So the email that lands in your inbox can come from a real Microsoft account with a real-sounding school or company behind it. Somebody else’s school 🫥

CoGUI and Iron Man are the kits sold through it: ready-made fake websites plus the messages that lead to them. CoGUI was one of the most widely used, aimed mostly at people in Japan and the US, and by the middle of this year it was increasingly being replaced by Iron Man. No, not that one. Tony Stark has an alibi, and his suit doesn’t run on a subscription 🦾 This Iron Man, Microsoft says, comes with “more than 2,300 templates” impersonating banks, shops, healthcare providers, transport authorities, police and government agencies. Resecurity, which helped with the takedown, went through the catalogue  and counted 2,360 entries covering 130 countries and areas. The most-copied brands were DHL with 37 templates, DPD with 24, Apple with 23 and GLS with 22. Its newest entries were dated October 1, so the catalogue was still growing two weeks ago

And the best detail in the whole thing: Iron Man is sold as a subscription to its seller’s licence server, and when Resecurity ran the admin panel it checked its licence roughly every twenty seconds. Even phishing gangs pay a monthly fee to keep their tools running. Welcome to the club 🙄

So who’s behind it? Microsoft says, “with high confidence”, that the kits were built by Chinese-speaking threat actors, and that Iron Man’s admin panels sat mostly with China-based hosting providers. Resecurity, which got inside the Chinese-language communities where the kits are sold, says it confirmed no real-world identity for any of the accounts it saw. So: a language, a hosting bill, and no names. Nobody is saying where anyone actually sits

Somebody is watching you type

The old picture of phishing is a fake page that quietly saves whatever you type and sends it off later. These kits are more hands-on. Microsoft describes what it calls “live, interactive phishing”: the kit sends what you type back over a live connection, and “the operator monitors each victim’s progress and manually controls what the victim sees next.” In plain words: a scammer is watching. They can have a ping sent to their Telegram the moment you enter a login, a card number or a verification code

That last one is why this is worse than it sounds. When a page with a person behind it asks for the code your bank just texted you, the likeliest reading is that they’ve just used your card or your password on the real site, set off the real code, and are waiting for you to read it to them. Your two-factor check is working perfectly. For them 🤷‍♂️

The pages also hide from anyone who isn’t a likely victim. Microsoft lists geofencing (“restrict access to configured countries only”), fake CAPTCHA checks to stop the automated scanners that security companies use, and IP allow and block lists to keep researchers out. Which is why the link that opened a perfect “toll payment” page on your phone can show your techy cousin nothing but a blank screen. A scam page with a bouncer at the door 🕶️

Is it over, then?

Microsoft has disabled more than 20,000 accounts tied to YAM Store and says it’s blocking more than 100,000 impersonation domains. That’s real damage to the business. It’s also a takedown of domains and accounts, and these operations were built to move: Resecurity notes the operators rotate the infrastructure in front of the kit, sometimes using domains their own customers registered. Microsoft’s announcement says nothing about anyone being arrested. So expect fewer of these texts for a while, then a new name on the same templates. Whack-a-mole, now with a court order. We’d love to be wrong about this one

You tapped. Now what?

If you only opened the link and closed it, you’re very probably fine. Close the tab, delete the text, report it as junk. Everything else depends on what you typed

• A card number: call the number on the back of the card, not one from any message, and have the card cancelled. Watch the statement for the small test charges that often come first
• A password: go to the real site by typing its address or opening its app, and change that password there. Then change it everywhere else you used the same one, because that list is exactly what the scammer will try next. Use “sign out of all devices” if the site has it
• A verification code: assume the account is already in someone else’s hands, because a scammer watching live rarely wants a code for any other reason. Change the password, sign out every session (a signed-in session keeps working after the password changes on plenty of sites), check the recovery email and phone number haven’t been hijacked, and use the original site’s account-recovery path if you’re already locked out
• Personal details (address, date of birth): nothing to change, but expect more convincing messages that use them

For next time, the advice in Microsoft’s write-up  is the right one: check with “the purported sender” by calling the organisation directly, on a number you already know, and treat urgency as the red flag it is. A toll authority that will genuinely double your fine in two hours is rare. A phishing kit that says so is not. Microsoft also recommends passkeys, mostly to the companies its write-up is aimed at, and they’re worth turning on wherever a site offers them, with good reason: a passkey is tied to the real site, so there’s nothing to type into a fake one

Where a password manager helps, and where it doesn’t

Start with the $3.95 page. It wants your card number, and no password manager on earth stops you typing a card number into a website. That one is on you and a phone call to the toll company

The lures that ask you to sign in are different. “Your Amazon parcel couldn’t be delivered, sign in to reschedule.” “Your Apple account is locked.” “Your Microsoft 365 mailbox is full.” Here the fake page needs a password you already have, and that’s where the tool you keep it in matters

Vauz  only fills a login on the site it was saved for, and it asks your browser which site that is, so a page can’t talk its way into your Amazon login by looking like Amazon. Even on the real site, a login only leaves Vauz after you’ve approved that site, in the prompt from the Vauz app that names it. Before Vauz fills anything, its browser extension also checks whether the address you’re on is built to be mistaken for a well-known site. An address that uses swapped-in characters to pass for one, like arn4zon.com with an r and an n posing as an m and a 4 posing as an a, gets no autofill at all. One that borrows the name, like a site called amazon-something.com that isn’t Amazon, gets an orange warning above the login field that says which site you’re really on. That check runs inside the extension, and the impersonation part of it works from a list of commonly impersonated sites. A fake that imitates no site on the list, built from ordinary letters, passes without comment, and a toll site nobody’s heard of isn’t on ours. So the rule from our piece on fake Google sign-in windows still applies: when your password manager won’t fill, believe it, and don’t copy the password across by hand because autofill is “being weird”

Vauz lives on your computer for now, and most of these texts land on your phone. A phone version of Vauz is on the way (consider this a sneak peek 👀), but whatever it ends up doing, the phone rule is shorter: don’t tap. Open the toll company’s app or type its address yourself, and if you really owe $3.95 it’ll be there

What to watch

Whether Iron Man gets a sequel under a new name, and how quickly. The other Iron Man got three films, and these guys don’t even need a script. Whether YAM Store’s habit of taking over abandoned school and company tenants gets the attention it deserves from the people who let those names expire. And whether anyone ends up in a courtroom, rather than just their domains. Until then, the toll you forgot to pay is still the one you never drove through 🛣️