Microsoft Kills 750 Million Phishing Emails at the Source

Microsoft, working alongside Japan's National Police Agency and healthcare security group Health-ISAC, obtained a US court order this week to seize and redirect domains powering three phishing platforms: YAM Store, CoGUI, and Iron Man. The full announcement is available according to The Record.

Together, the three platforms sent over 750 million malicious messages to Microsoft customers since January — targeting people in more than 150 countries. If you have received a fake toll fine text, a bogus parcel delivery notice, or a spoofed bank email recently, these are the people responsible.

Iron Man is a phishing-kit-as-a-service (a subscription service that lets criminals rent ready-made scam infrastructure) offering over 2,300 pre-built fake pages impersonating postal services, tax agencies, banks, and telecoms. CoGUI provided similar fake websites before criminals migrated to Iron Man mid-year. YAM Store is an initial access broker marketplace — a criminal marketplace selling compromised Microsoft and Google accounts — that let attackers buy cheap fraudulent accounts to power their campaigns.

Microsoft disabled more than 20,000 accounts connected to YAM Store and is blocking over 100,000 impersonation domains.

What to do: These platforms stole login credentials and banking information. If you have clicked a link in an unexpected delivery or fine text in the past year, check your Microsoft, banking, and email accounts for any logins you do not recognise. Enable multi-factor authentication (a second verification step beyond your password) on any account that supports it.

Security consultancy Booz Allen Hamilton ran a series of controlled tests placing AI agents inside an isolated industrial control network — the type of system that runs factory equipment, power grids, and water treatment plants. The results, presented at SecurityWeek's ICS conference, are worth understanding, according to SecurityWeek.

The agents were given no prior knowledge of the systems. In one test, a model moved from an initial network breach to taking actions inside the industrial network in just over 16 minutes. In another, it located a robotic arm, mapped its safety limits, and moved it. Existing defences slowed some actions but none stopped the agents consistently.

The implication: industrial environments that rely on obscurity — the assumption that an attacker would not know how the system works — can no longer count on that protection. Operators of critical infrastructure should prioritise network segmentation, removing implicit trust between systems, and fast detection of unusual physical changes.

What Windows Shell is: The Windows Shell is the core interface layer of Microsoft Windows — it handles how files are opened, executed, and displayed on your computer.

What it is: This is a zero-day (a vulnerability that was being exploited before a fix existed) that lets attackers bypass Mark of the Web (MotW) protections. MotW is a tag Windows attaches to files downloaded from the internet, telling security tools like Defender SmartScreen to treat them with caution. Bypassing it means a malicious file can open without triggering any warning.

Who's at risk: Any Windows user who opens email attachments or downloads files. An attacker must convince the target to open a crafted file — social engineering (manipulating someone into taking an action) is required, but that is exactly how most phishing works.

CVSS: 8.8 (High — patch immediately)

Root cause: The Shell fails to correctly validate MotW metadata on specially crafted files, allowing the tag to be stripped or ignored. This breaks the chain of trust between downloaded files and the security tools designed to inspect them.

Attack vector: An attacker sends a malicious file via email or message. The target opens it. Because MotW is bypassed, Defender SmartScreen does not raise an alert, and the file executes with no visible warning.

Detection strategies: Look for SmartScreen bypass events in Windows Defender logs; unexpected execution of recently downloaded files; and files with mismatched or absent Zone.Identifier alternate data streams.

Recommended actions:

1. Apply Microsoft's October 2026 Patch Tuesday updates immediately
2. Block macro execution in Office for files from external sources
3. Monitor endpoint logs for SmartScreen suppression events

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-96951 — the Windows Shell zero-day covered above — to its Known Exploited Vulnerabilities (KEV) catalog and instructed all federal civilian agencies to patch by Friday, 16 October. The advisory is available from The Record.

For everyone else: that Friday deadline is a useful benchmark. Microsoft's October Patch Tuesday fixed over 1,400 vulnerabilities, including this actively exploited flaw. Waiting for your device to update on its own schedule is reasonable for routine patches — less so when a zero-day is already in use.

How to check: On Windows, open Settings → Windows Update → Check for updates. If the October 2026 updates are available, install them. A restart will be required.

Polish Prime Minister Donald Tusk announced this week that NSO Group — the Israeli maker of Pegasus spyware — had technical access to surveillance data collected by the previous Polish government, according to The Record. Investigators found the vendor retained exclusive control over the system's server module, meaning the government never fully controlled what it was running. The case sets a significant precedent: governments acquiring commercial spyware may be inadvertently handing sensitive citizen data to foreign entities.