Unpaid toll? Missed delivery? Microsoft moves to disrupt a global cybercrime marketplace

blogs.microsoft.com Oct 14, 2026

Unpaid toll? Missed delivery? Microsoft moves to disrupt a global cybercrime marketplace

Curated by Shubham · TechCapsules · Oct 14, 2026

AI-summarised brief · reviewed before publication

Microsoft and Japan’s National Police Agency uncovered a sprawling Chinese‑language cybercrime marketplace that sells stolen accounts, hosting services, and phishing tools. The investigation, expanded with partners such as JC3, Cloudflare, and Oracle, traced the marketplace’s three core components—YAM Store, CoGUI, and Iron Man—to over one billion malicious messages sent to more than 75,000 organizations worldwide, including 750 million targeting Microsoft customers. The operation generated tens of millions of dollars and exploited compromised domains to create fraudulent Microsoft 365 accounts for resale.

💡 Why It Matters

· The takedown exposes how cybercriminals monetize mass phishing at scale, revealing a sophisticated supply chain that threatens global digital infrastructure.
· By dismantling key marketplace nodes, Microsoft and partners reduce the tools available for large‑scale credential theft and protect millions of users from future attacks.

Read full article on blogs.microsoft.com

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft, Health‑ISAC, JC3, and a coalition of private firms dismantled three phishing kits—CoGUI, Haozi, and Iron Man System—responsible for over one billion scam emails and SMS messages since January 2026. The kits, linked to the YAM Store marketplace, targeted more than 75,000 organizations across 150 countries, exploiting compromised Microsoft and Google cloud environments. The operation, authorized by court order, exposed shared code and infrastructure among the kits, revealing a coordinated Chinese‑speaking cybercriminal ecosystem.

💡 The takedown halts a massive, globally‑scaled phishing infrastructure that siphoned millions of dollars, underscoring the effectiveness of cross‑sector collaboration in neutralizing sophisticated cybercrime networks.

thehackernews.com · Oct 14

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a command‑injection flaw in Collabora Online’s Built‑in CODE Server app for Nextcloud, allowing unauthenticated web shell deployment when the local document server was offline. The vulnerability, reported on GitHub on September 10, enabled attackers to execute arbitrary commands as the web‑server user. Collabora released a patch in version 26.4.303 on September 11, later issuing CVE‑2026‑110447 on October 14. The fix requires Nextcloud 30+; older installations must upgrade or remove the app. The flaw affected only the built‑in app, not standalone Collabora servers.

💡 The incident exposes how optional add‑ons can become critical attack vectors, underscoring the need for timely updates in open‑source ecosystems. It also highlights that disabling an app is insufficient; proper version control and removal are essential to safeguard server integrity.

thehackernews.com · Oct 14

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that the Ivanti Connect Secure (ICS) authentication bypass flaw (CVE‑2026‑104935, CVSS 8.6) is actively exploited, allowing remote attackers to run arbitrary commands on affected versions (25.1.1.1 and earlier, 25.1.2.2 and earlier, 22.8R2.4 and earlier). CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch by October 16, 2026. Previdian’s honeypots logged 105 exploitation attempts from Singapore and the U.S., while Volexity documented credential theft and log tampering by the criminal actor UTA0576.

💡 The breach demonstrates that even widely deployed VPN solutions remain prime targets for coordinated, stealthy attacks that can bypass authentication and harvest credentials. The rapid escalation from testing to full exploitation underscores the urgency for organizations to patch immediately and conduct forensic investigations.

thehackernews.com · Oct 14

Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen…

Security researchers demonstrated that a four‑byte write and timing flaw in Windows’ VBS enclave allowed them to execute code inside the protected memory area used by Microsoft Defender SmartScreen’s Enhanced Phishing Protection. The proof‑of‑concept attack, published by Doyensec on October 13, 2026, exploited a local vulnerability in SFAPE.dll, enabling code execution within the enclave without reading passwords. Microsoft patched the issue in the September 8, 2026 cumulative update (KB5124008) and rated it Critical (CVE‑2026‑83498). The flaw highlighted a weakness in the enclave’s isolation mechanisms.

💡 The breach shows that even highly trusted Windows components can be subverted by local attackers, undermining the assumption that VBS enclaves provide absolute protection. It underscores the need for stricter enclave validation and broader blocklisting to prevent future exploits.

thequantuminsider.com · Oct 14

SEALSQ Presents Research on Side-Channel Attacks Against ML-KEM

SEALSQ Corp presented peer‑reviewed research at LightSec 2026, revealing a side‑channel attack that exploits the encoding step of ML‑KEM key generation. The study combines profiling techniques with lattice reduction to recover sensitive data under realistic conditions and proposes practical countermeasures. The work underscores implementation risks in NIST‑standardized post‑quantum cryptography and complements SEALSQ’s QS7001 secure element, which embeds ML‑KEM and ML‑DSA on a RISC‑V architecture and is undergoing Common Criteria EAL5+ certification.

💡 The findings expose a vulnerability in a widely adopted post‑quantum algorithm, prompting immediate scrutiny of hardware implementations. SEALSQ’s dual focus on research and product security positions it to influence industry standards and protect critical infrastructure during the post‑quantum transition.

thehackernews.com · Oct 14

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain…

Security firm XBOW used OpenAI’s publicly available GPT‑5.6 Sol model to chain three previously unknown Chrome bugs into a full‑chain exploit in six days. The attack runs arbitrary Windows code when a user merely loads a web page, bypassing Chrome’s nested sandboxes without clicks or downloads. Google confirmed and patched all three flaws—two in Chrome 152.0.7977.65 and 152.0.7977.82, and a WebP‑related V8 bug—after which XBOW received the program’s maximum $250,000 reward. XBOW estimates the AI‑driven effort cost about $40,000 in compute. Researchers directed the AI to search source code, generate proofs of concept and draft exploit code, while humans selected targets and assembled the final chain. The work coincided with Black Hat and DEF CON in early August for the cybersecurity community globally.

💡 The cheap, six‑day AI‑crafted Chrome exploit demonstrates that high‑impact browser attacks are no longer limited to well‑funded groups, urging defenders to accelerate patch cycles and incorporate AI threat modeling.