Back in 2023 I gave a talk called Your Phishing Program is a Waste of Time and Money (or rant, depending on your angle). This week Microsoft published what the other side’s program looks like. Spoiler: theirs has a storefront, a sub-reseller tier, and over 2,300 templates.
They built a business
Microsoft’s write-up describes YAM Store, an access broker selling hijacked or fraudulently obtained Microsoft and Google cloud environments. It even used AI-generated content to stand up fake organizations, including a fake nonprofit. The phishing kits sold alongside it (CoGUI, Haozi, and Iron Man System) facilitated over one billion phishing emails and texts to more than 75,000 organizations since January 2026. Most of the US lures are tolls, parking, and traffic fines.
BleepingComputer reports that a court-ordered takedown followed: domains were seized, over 20,000 accounts were deactivated, and 100,000 domains were blocked. This is good news, but we all know it won’t be the last takedown we need.
Concern #1: Click rate is a vanity metric
When someone is sending a billion lures, the difference between a 3% and a 5% click rate tells your board nothing. Somebody will click. The useful question is what that one click gets the attacker.
Microsoft’s own guidance leads with passkeys, MFA everywhere, phishing-resistant MFA for privileged accounts, least privilege, and Zero Trust (which I’ve talked about before). These kits also used device-code phishing to grab authentication tokens, which walks right around a “just don’t type your password” mindset.
Concern #2: MFA coverage, not MFA adoption
“We have MFA” isn’t the same thing as “a password alone doesn’t work anywhere.” According to Specops (a sponsored piece, so keep that in mind), on August 4 an Akira ransomware affiliate sprayed passwords at a SonicWall VPN. About seven minutes later one worked: valid credentials, no MFA on that account. Roughly two hours later they were on the domain controller over RDP.
Specops also cites Mandiant data showing compromised credentials as initial access in 21% of 2025 ransomware incidents (where the entry point was known), with RDP used for lateral movement in around 85% of them. Their best line is the question everyone should be asking themselves: where can a password still be used on its own?
Concern #3: Now they’re phishing your AI assistant
Malwarebytes, relaying Barracuda research, describes phishing emails with hidden instructions aimed at AI summarizers. In one example, the hidden text tried to add a fake priority action: change a vendor’s payment details. My favorite quote from it: “People have learned to distrust the email. They haven’t learned to distrust their AI assistant.” Limit what your assistants can do, and require a human to sign off on anything that moves money.
Don’t forget the customers
For banks, the phishing program can’t stop at the employee inbox. Malwarebytes also flagged texts that are nothing but your name and a question mark, built to get a “Who’s this?” reply. Names and numbers come from breached data, and a reply tells the scammer your number is live. The advice to give customers is simple: don’t reply, report and block, and reach people through a channel you already trust.
Perhaps a better framing:
Stop asking “how many people clicked?” and start asking “what happens when someone does?”
- Retire click rate as the headline metric. Report phishing-resistant MFA coverage, time-to-report, and how often you detect and respond within your target windows.
- Inventory every place a password still works alone (VPN, RDP, Windows logon, legacy AD services).
- Put guardrails on AI assistants, with human sign-off on payments and vendor changes.
As I wrote a while back in Groundhog Day?, avoid the vanity metrics and focus on the basics.
Somebody’s going to click. Make sure it doesn’t matter much when they do.
