The message says you have an outstanding issue. A shipment, a payment, or an issue with your account. It’s brief, looks like an everyday message, and asks you to click a link. Behind it, however, there may be an entire chain of people and services.
On October 14, 2026, Microsoft published a report on an organized phishing ecosystem: toolkits developers, infrastructure vendors, and buyers who use these services to carry out attacks. The practical implications for the average user are significant. The scam can reach a cell phone as a short message, while it is produced on a large scale.
What the investigation revealed
At the center of it all is the YAM Store dark market and three phishing tools: CoGUI, Haozi, and Iron Man System. According to Microsoft, since January 2026, the actors behind these tools have facilitated the sending of more than one billion deceptive emails and SMS messages to over 75,000 organizations worldwide.
These figures pertain to the activity described in this specific investigation. They do not mean one billion victims, nor do they prove that every suspicious SMS we receive in Greece originates from the same network.
The infrastructure included compromised or fraudulently obtained cloud environments, which were resold for use by other perpetrators. This shows how tools and access can be shared among different members of a criminal network.
The trap works because it looks like a minor pending issue
The term “phishing” describes an attempt to steal information through deceptive communication. When it’s done via text message, you’ll also see it referred to as “smishing.” The target may be your password, financial information, or authorization for an action you didn’t realize you were agreeing to.
The FTC describes common pretexts: alleged suspicious activity, a payment issue, a need to verify information, or a fake invoice. The content creates a sense of urgency and presents the link as an easy solution.
Consider a hypothetical example: you’re actually waiting for an order and receive a message saying that some delivery information is missing. The fact that you’re expecting a package makes the story plausible. However, it does not confirm the identity of the person who sent you the message.
Why “it looks legitimate” isn’t enough
A logo can be copied. A link can contain familiar words and lead somewhere else. Microsoft recommends checking the actual URL and verifying unexpected requests, even when they appear to come from a recognizable source.
Even correct Greek grammar is not a guarantee of authenticity. Grammatical errors can be a useful indicator when they’re present, but their absence does not prove that the sender is trustworthy.
If you land on a website, HTTPS indicates that the connection is encrypted. It does not certify that the site owner is who they claim to be. The crucial question remains: which service did you open, and via which path?
The three-step process
- Close the message for a moment. Don’t reply, and don’t give in to pressure to act immediately.
- Open the service yourself. Use the app you already have or the URL you know. To verify, find contact information independently of the suspicious text message.
- Check if there’s actually an outstanding issue. If you can’t find what the message claims, ask for clarification from the official customer service.
This process helps even when you can’t judge a complex URL. Instead of trying to prove that the suspicious link is safe, access the service through your own familiar route.
If you clicked on a link or entered your information
First, figure out what happened. Clicking a link, entering a password, and authorizing a transaction are different situations. Don’t assume you’ve lost everything just because you opened a page, but don’t ignore what you typed or authorized.
- For your account password: Change it through the official service and check other accounts where you used the same password.
- For potential email access: Check your devices, recent activity, recovery information, and any unfamiliar forwarding rules.
- For credit card information or transactions: Notify your bank immediately through its official channel.
- For a file or app you installed: Have your device scanned and use reliable security tools.
Save the message and any related details to report the incident. Do not repost them with active, dangerous links or other people’s personal information.
Two habits worth changing starting today
Use different passwords for your important accounts and enable additional login protection. Where supported, passkeys offer protection against phishing during the login process. This does not eliminate the need to verify a payment or other authorization.
Within your family or a small group, also agree on a simple practice: before paying an unexpected bill or changing a business partner’s contact information, confirm the details using a previously agreed-upon method of communication. No one needs to feel embarrassed for asking for a double-check.
Illustrative photo: Jonas Leupe / Unsplash.