Your Fake Toll Fine Text Came From a Factory: 1 Billion Scams Just Got Shut Down

That Fake Toll Text Was Not a Coincidence

Someone built a factory to send it. On October 14, 2026, Microsoft and its partners seized the domains powering three industrial-scale phishing operations: CoGUI, Haozi, and Iron Man System. A US federal court in Florida signed the order. The action lifted the lid on something most people never see, a full-service criminal business that sells scams the way software companies sell subscriptions.

What Is a Phishing Kit, and Why Should You Care?

A phishing kit is a ready-made fraud package. Think of it like a franchise. A criminal mastermind builds the infrastructure: fake login pages, automated text-blast tools, templates that look like your bank or the state DMV. Then they sell access to anyone with a few hundred dollars and a grudge. The buyer does not need to know how to code. They just point, click, and wait for stolen credentials to roll in.

These three kits, CoGUI, Haozi, and Iron Man System, were sold through a place called YAM Store, an underground Chinese-language marketplace. YAM Store did not just sell the kits. It also sold the results. Stolen Microsoft 365 logins, Azure for Education accounts, Google accounts, all available to the next criminal in line. One ecosystem, closed loop, continuous revenue.

Iron Man was built specifically for American targets. Its templates impersonate government agencies dealing with traffic fines, toll violations, and parking fees. That fake EZPass text you almost clicked? Built by someone who never met you, sold to someone who does not care about you, blasted to millions of people at once.

How Big Was This Operation?

Since January 2026, these three kits sent over one billion phishing emails and SMS messages. They hit more than 75,000 organizations across 150 countries. Of those messages, 750 million specifically targeted Microsoft customers.

Those are not typos.

To put it another way: if you received a suspicious text about an unpaid toll this year, there is a reasonable chance it came from this same pipeline. You were not specially targeted. You were one data point in an automated sweep.

Microsoft disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains. Health-ISAC and Japan's Cybercrime Control Center co-signed the legal action. That kind of cross-border coordination is unusual, and it signals how seriously the industry took this network.

What Were They Actually Stealing?

The kits harvested three things in real time: login credentials, banking details, and personal data. "Real time" is the part that matters. When you typed your password into a fake page, someone on the other end of the world received it within seconds. They could log into your account before you finished closing the browser tab.

That stolen access did not sit in a folder somewhere. It went straight to YAM Store, priced, listed, and sold to the next buyer. Your Microsoft account. Your email. Your bank portal. On a marketplace. With a cart.

What Do You Do Right Now?

These domains are seized. These specific kits are disrupted. That does not mean the operators stopped working. It means they are rebuilding. Here is what protects you in the window between now and the next operation.

1. Turn on two-factor authentication everywhere. Use an authenticator app, not SMS. A stolen password is useless without the second factor. This is the single highest-impact thing you can do today.
2. Switch to passkeys where you can. Google, Apple, and Microsoft all support them. A passkey cannot be phished because you never type it anywhere.
3. Freeze your credit. Free at all three bureaus. A freeze blocks anyone from opening new credit in your name even if they have your Social Security number and banking details. Takes five minutes to set up, takes five minutes to lift when you actually need credit.
4. Do not click links in texts about fines, tolls, or fees. Go directly to the official state or agency website by typing the URL yourself. Every legitimate agency will accept payment through their own site.
5. Check your accounts for unfamiliar logins. Microsoft, Google, and Apple all show you a list of recent sign-ins. Look at it today.
6. Use a data-removal service. Services like DeleteMe or Kanary find your personal information on data broker sites and request removal. Less data floating around means less raw material for the next phishing campaign.
7. Report suspicious texts to 7726 (SPAM). Your carrier uses these reports to block numbers. It takes three seconds.

The Truth Behind the Inbox Flood

What this operation reveals is that phishing is no longer a craft. It is a supply chain. There are builders, distributors, buyers, and secondary markets for stolen goods. Every node in that chain is run by someone who has never met you and will never face consequences from hurting you directly.

The people getting arrested are rarely the ones who sent you that text. They are the developers who built the kit years ago, the marketplace operators who hosted the store, the low-level buyers who ran the campaigns. Dismantling one node, even a large one, does not end the chain. It shifts it.

That is not a reason to feel helpless. It is a reason to harden your own position and stop assuming that being a regular person makes you an unlikely target. You were always the target. You just did not know a billion-message factory was pointed at you.

Do this now:

• Enable 2FA with an authenticator app on your email, bank, and Microsoft or Google account
• Freeze your credit at all three bureaus (free, reversible)
• Never click a toll or fine link from a text, go to the official site directly
• Check recent sign-in activity on your accounts today

Sources

• thehackernews.com
• helpnetsecurity.com