An international law enforcement operation has dismantled a cybercrime ring responsible for sending more than one billion scam messages to mobile phones and inboxes worldwide. On October 14, 2026, Microsoft collaborated with global police agencies, healthcare defense groups, and cybersecurity partners to seize the servers, web domains, and digital toolkits fueling the fraudulent campaigns. The coordinated operation severed a critical pipeline that criminals relied on to steal passwords, financial credentials, and personal information across the globe.

Authorized by an emergency seizure warrant from the U.S. District Court for the Southern District of Florida, the coordinated disruption dismantled “YAM Store” (tracked as Storm-3119), an underground marketplace selling stolen corporate cloud environments. The operation also took down three affiliated turnkey phishing kits—the Iron Man System (tracked as Storm-2990), CoGUI, and Haozi—which contained over 2,335 malicious templates. In total, investigators deactivated more than 20,000 illicit cloud accounts, blocked 100,000 deceptive web domains, and disrupted attack infrastructure that had targeted over 75,000 organizations across more than 150 countries.

How the Phishing Syndicate Operated

According to technical analysis from Microsoft Threat Intelligence, the syndicate operated as a full-service underground business, providing buyers with everything required to execute large-scale phishing attacks. The criminal supply chain operated across five primary phases:

1. Account Acquisition: Operators acquired abandoned internet domains from legitimate businesses, re-registered them to pass security checks, and fraudulently established genuine Microsoft 365 and Google Workspace accounts.
2. Turnkey Toolkits: The syndicate bundled these verified enterprise accounts with automated phishing platforms like the Iron Man System, which provided prebuilt templates mimicking trusted banks, package carriers, and government agencies.
3. Mass Distribution: Buyers sent waves of text messages and emails from authentic cloud environments, allowing their lures to bypass standard spam filters.
4. Credential Harvesting: When recipients clicked lure links, malicious proxy servers captured entered login passwords, authentication codes, and payment details in real time.
5. Asset Laundering: Stolen funds and marketplace subscription fees were moved through cryptocurrency exchanges, where researchers at TRM Labs helped track and freeze illicit digital assets.

Why Recognizing These Phishing Lures Still Matters

The seizure of YAM Store dealt a major blow to a global cybercrime network, immediately taking hundreds of thousands of active fraud domains offline. However, the commercial model behind these attacks remains intact across the broader threat landscape. As automated kits lower the technical barrier to entry, rogue actors can easily purchase replacement infrastructure to launch new campaigns. Recognizing the difference between how these scammers act and how a legitimate organization behaves can help you spot future variations of these phishing schemes. 

Attack Vector	Common Pretext	Scammer Red Flag	Legitimate Entity Behavior
SMS (Smishing)	Unpaid parking tickets, traffic violations, or municipal road tolls.	Demands immediate payment via an included shortened link to avoid license suspension.	Municipal agencies send citations via postal mail and direct payments to an official government portal.
SMS or Email	Package delivery exceptions (e.g., postal services, FedEx, or UPS).	Claims a package cannot be delivered until an administrative fee (typically $1.50–$5.00) is paid online.	Parcel carriers provide tracking numbers verifiable directly on their official mobile app or primary website.
Email	Corporate account or cloud storage password expiration warnings.	Demands you verify login credentials within 24 hours through an external sign-in form.	Legitimate enterprise platforms manage credential resets within secure internal system settings, not via external forms.
Payment Screen	Fake banking verification or credit card confirmation forms.	Requests two-factor authentication codes, debit PINs, or full billing details on an unfamiliar domain.	Financial institutions never prompt for PINs or temporary codes on third-party payment redirect pages.

How to Protect Yourself from Emerging Phishing Schemes

Because accessible phishing kits make it easy for scammers to replace dismantled networks, staying safe requires consistent verification habits and practical safeguards:

• Navigate independently to official service portals. Never click links inside unexpected text messages or emails regarding parking fines, road tolls, or shipping fees. Open your browser and navigate directly to the verified agency or company website.
• Check the full website address in your browser. Scammers frequently register web addresses that look nearly identical to authentic brands by changing a single letter. Confirm that the URL in your browser bar matches the organization’s official domain before typing any information.
• Switch to an authenticator app for account logins. Instead of receiving login verification codes through SMS text messages, consider using an authenticator app on your phone. Phishing pages can capture texted six-digit codes in real time, but app-based verification makes it much harder for scammers to intercept your account access.
• Verify delivery notifications using your original tracking number. If you receive a message claiming a package is delayed, locate your original purchase confirmation and enter the tracking number directly into the delivery carrier’s official website.
• Treat tiny fee requests as major red flags. Scammers deliberately ask for small sums, such as a $2.50 processing fee, to lower your guard while capturing your full credit card number, expiration date, and security code.

What to Do If You Have Already Been Targeted

If you interacted with a suspicious link, submitted account credentials, or paid a fraudulent fee, take these immediate recovery steps:

1. Sever contact immediately. Do not click further links, reply to the message, or send additional payments.
2. Contact your financial institutions. Call your bank or card issuer immediately to report unauthorized transactions, cancel compromised cards, and dispute fraudulent charges.
3. Update passwords across shared accounts. Reset credentials on any account that shared the exposed password, and select the option to sign out of all active devices in your account settings.
4. Place a credit freeze with the major bureaus. Block scammers from opening fraudulent lines of credit in your name by freezing your credit files with Equifax, Experian, and TransUnion.
5. Submit an official identity theft report. If personal identifiers such as your Social Security number or driver’s license details were submitted, file a recovery plan through the federal identity theft reporting portal.
6. Preserve evidence. Save screenshots of the scam message, sender phone number or email, website URLs, and payment records before deleting anything.

How to Report Phishing Scams

Reporting cybercrime infrastructure helps industry defenders and law enforcement track repeat patterns and build cross-border cases:

• Federal Trade Commission: Submit consumer fraud and deceptive business reports through the Federal Trade Commission complaint assistant.
• FBI Internet Crime Complaint Center: File reports involving significant monetary theft, wire fraud, or corporate account compromise with the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Report spam text messages, smishing campaigns, and spoofed phone numbers through the Federal Communications Commission consumer center.
• Local Law Enforcement: File a police report with your local department if you experienced direct financial loss, as financial institutions frequently require a police report number during fraud investigations.
• Mobile Carriers: Forward deceptive text messages directly to the cellular carrier spam reporting shortcode at 7726 (SPAM).

Major takedowns disrupt criminal supply chains and hold malicious operators accountable, but the tools behind these schemes continue to evolve. Verifying unexpected payment requests directly with official organizations, monitoring your financial statements regularly, and securing your accounts with strong authentication remain dependable defenses against online fraud.

The post Global Takedown Hits Network Behind 1 Billion Scam Messages appeared first on McAfee Blog.

Financial scammers are increasingly targeting older Americans, using deceptive online platforms, high-pressure phone pitches, and complex impersonation schemes to drain hard-earned savings. While older consumers are more likely to report suspicious solicitations, those who get caught in these elaborate operations face catastrophic financial consequences. As digital payment systems and online networks evolve, organized criminal rings are extracting record amounts of capital from people preparing for or living in retirement.

On October 19, 2026, the Federal Trade Commission (FTC) submitted its annual report to Congress, Protecting Older Consumers 2025–2026, detailing the rapid escalation of this trend. The report revealed that fraud losses reported by adults aged 60 and older reached approximately $3 billion in 2025, a fivefold increase from the $600 million reported in 2020. Since most victims do not report fraud to government agencies, the FTC estimates actual losses for older adults in 2025 ranged between $13.3 billion and $119.5 billion.

How Fraud Schemes Target Older Adults

The sharp rise in elder fraud is largely propelled by a surge in massive, individual six-figure losses. Combined losses from older adults who lost $100,000 or more increased nearly sevenfold between 2020 and 2025. While these severe losses represented only 6% of loss reports filed by older adults in 2025, they accounted for 70% of the entire $3 billion total.

Analysis of consumer reports reveals that these catastrophic losses were concentrated in these specific scam categories:

Investment Scams Promoted on Social Media

Investment fraud was the costliest category for older consumers in 2025, with $1.06 billion in reported losses, a 42% jump. Scammers use social media to pitch fake crypto, stock, or automated trading platforms, directing targets to fraudulent sites displaying falsified account balances. When victims request withdrawals, operators demand bogus “taxes” or “administrative fees” before freezing accounts.

Government and Business Impersonation Schemes

Government and business impersonators drew $870 million in losses ($448M government, $422M business). Government imposters claim bank accounts are tied to crime, while business imposters pose as bank or tech support fraud departments. Both fabricate urgent crises, coercing victims to transfer money to “protective custodial accounts” or government “lockboxes.”

Romance Scams That Exploit Trust

Romance scams caused $384 million in reported losses among older adults in 2025 (up 17%). Fraudsters build trust over weeks or months via social media or dating apps before fabricating urgent emergencies—like medical bills or foreign travel issues—to request repeated money transfers.

Prize, Sweepstakes, and Lottery Schemes

Prize and lottery scams cost older adults $143 million in 2025. Scammers contact targets via phone, mail, or online, claiming major prize wins from known brands but requiring upfront processing fees or taxes to release funds.

Tech Support Deception

Older consumers were over four times (324%) more likely than younger adults to report losing money to tech support scams. Alarming browser pop-ups prompt calls to fake technicians who gain remote access to computers and charge high fees for unneeded services.

Irreversible Payment Methods That Fuel the Losses

While credit cards were the payment method most frequently used by older adults (accounting for 28% of loss reports), payment channels that cannot be easily recalled accounted for the largest aggregate dollar amounts. Bank transfers and payments accounted for over $1.03 billion in reported losses, while cryptocurrency transfers totaled $603 million. In impersonation and sweepstakes scams, criminals also routinely demand payment through retail gift cards, direct bank wires, physical cash sent via couriers, or cash deposits into automated Bitcoin kiosks.

The table below details the top six fraud categories ranked by total reported dollars lost by older adults (ages 60 and older) in 2025, alongside the year-over-year percentage change compared to calendar year 2024.

Fraud Category	2025 Reported Losses (Age 60+)	Change from 2024	2025 Loss Reports	Common Tactic
Investment Scams	$1.059 billion	+42%	10,578	Counterfeit crypto dashboards and fake trading platforms.
Government Imposters	$448 million	+20%	12,183	Threats of arrest or asset seizure to force money transfers.
Business Imposters	$422 million	+12%	24,820	Fake bank fraud alerts directing funds to “safe” accounts.
Romance Scams	$384 million	+17%	6,832	Fabricated emergencies or joint investment pitches from online partners.
Prizes, Sweepstakes & Lotteries	$143 million	-1%	5,280	Upfront fee demands to release fake winnings.
Tech Support Scams	$126 million	-21%	5,334	Browser pop-ups prompting calls to bogus technicians.

Warning Signs of Elder Scams

Federal agencies participating in the nationwide Never Ever campaign, led by the FTC, the Department of Justice (DOJ), and the Department of Health and Human Services (HHS), have identified clear warning signs that expose fraudulent communications.

• Demands to transfer money to “protect” it: Legitimate banks and government agencies never tell you to move your funds into a separate account, a crypto kiosk, or a temporary vault to keep it safe from fraud.
• Insistence on specific, unusual payment methods: Demands to pay using retail gift cards, cryptocurrency, money-transfer apps, bank wires, or envelopes of cash collected by a courier are red flags that you may be dealing with a scam.
• Demands for complete secrecy: Fraudsters often order you to stay on the line, instruct you not to speak with family members, and supply fake cover stories to recite to bank tellers during cash withdrawals.

How to Protect Yourself and Older Relatives

You do not need to be a technical expert to guard against these schemes. Following five straightforward habits can help protect household savings from scams:

1. Hang up and call a number you know is real. If you get a call or text claiming your bank account, credit card, or Social Security number is in danger, hang up immediately. Do not press any buttons or call back the number that contacted you. Pick up your physical debit card, credit card, or an official paper statement, and call the customer service phone number printed on the back.
2. Talk to a family member or friend before you pay. Scammers rely on panic to make you act before you have time to think. Make it a personal rule to discuss any unexpected financial request, sudden investment tip, or prize notification with a trusted relative, neighbor, or bank employee before you authorize any transfer.
3. Refuse all requests to buy gift cards or use Bitcoin machines. If anyone on the phone tells you to go to a retail store to buy gift cards, or asks you to deposit cash into a Bitcoin ATM to clear a bill or protect your savings, stop. Legitimate businesses and government offices do not accept payment through these methods.
4. Restart your computer if an alarming warning screen appears. If your screen suddenly freezes with loud alarms or an urgent warning saying you are hacked, never call the phone number shown. Press and hold your computer’s power button until everything turns completely off, wait 30 seconds, and turn it back on. When you reopen your internet browser, click “Cancel” or the “X” if it asks to restore your previous pages.
5. Let unfamiliar phone calls go to voicemail. Scammers can alter the name and phone number that appear on your phone screen to look like a local courthouse, police department, or bank. Let calls from numbers you do not recognize go to voicemail. If a matter is truly legitimate, the organization will leave a message and send official mail.

What to Do If You Have Already Been Targeted

When money has been sent or sensitive personal details have been disclosed, acting promptly improves the chances of limiting damage and recovering funds:

• Cut off all communication: Discontinue every phone call, text exchange, and email thread with the scammer. Never send additional money to “release” previously transferred funds or pay supposed “withdrawal fees.”
• Contact your financial institutions immediately: Call your bank, credit union, or credit card company. Request an immediate recall on any recent wire transfers, flag fraudulent debit or credit charges, and ask the bank to secure your accounts.
• Request the Financial Fraud Kill Chain for wire transfers: If you sent a significant bank wire within the last 72 hours, submit a report immediately to the FBI Internet Crime Complaint Center. The FBI’s Recovery Asset Team works directly with domestic and international financial networks to freeze fraudulent wire transfers before they settle. In 2025, this process helped freeze $679 million in stolen funds.
• Contact the National Elder Fraud Hotline: Call the DOJ’s free hotline at 1-833-372-8311. Staffed by the Office for Victims of Crime, case managers provide direct support, help you organize reporting documentation, and connect you with local and federal resources.
• Place a security freeze on your credit reports: Restrict identity thieves from opening new lines of credit by freezing your credit files directly with the three national credit bureaus: Equifax, Experian, and TransUnion.
• Report identity exposure: If you provided your Social Security number, banking details, or driver’s license number, go to IdentityTheft.gov to receive a customized recovery plan.
• Preserve all records: Save written notes, phone numbers, text messages, emails, bank transfer confirmations, and cryptocurrency wallet transaction receipts to share with investigators.

How to Report Elder Fraud

Reporting scam attempts provides law enforcement agencies with the evidence required to identify criminal syndicates, freeze illicit assets, and bring enforcement actions. In fiscal year 2026, FTC enforcement actions resulted in more than $513 million returned to consumers of all ages.

Submit incident details through these official reporting portals:

• Federal Trade Commission: Submit reports through the FTC Fraud Reporting Portal, which feeds directly into the secure Consumer Sentinel Network used by thousands of law enforcement agencies nationwide.
• FBI Internet Crime Complaint Center: Report internet fraud, cryptocurrency theft, and wire transfers to the FBI Internet Crime Complaint Center.
• Federal Communications Commission: Report phone number spoofing and unlawful automated calls to the FCC Consumer Complaint Center.
• Local Police or Sheriff’s Department: File a formal police report with your local law enforcement agency. Banks frequently require a copy of an official police report to process fraud disputes.
• Specific Government Agencies: Report calls from Social Security imposters directly to the Social Security Administration Office of the Inspector General, and report tax-related scams to the Treasury Inspector General for Tax Administration.

Federal enforcement actions continue to target the infrastructure that enables these operations. In fiscal year 2026, the FTC secured a settlement requiring payment processor Nuvei to turn over $4.85 million for processing transactions for an overseas tech-support scheme that impersonated major US brands. The FTC also took action against operations like American Tax Service, requiring defendants to surrender nearly $10 million in cash and assets for running deceptive tax-debt telemarketing targeting older adults. Staying informed, hanging up on unsolicited calls, and checking in with loved ones remain the most dependable defenses against these escalating threats.

The post Elder Fraud Losses Surge to $3B: FTC Report and Prevention Tips appeared first on McAfee Blog.

The California Department of Education (CDE) announced on October 16, 2026, that unauthorized actors accessed an Educational Testing Service (ETS) server, compromising the educational and demographic records of millions of California public school students. The breach occurred between May 22, 2026, and September 18, 2026, exposing student names, dates of birth, home addresses, disability records, and state assessment scores across three academic years. 

While state officials confirmed that Social Security numbers and financial account details were not accessed, exposed personal files elevate the risk of secondary phishing attacks, fraudulent account creation, and child identity theft.

How the ETS Data Breach Happened

Unauthorized actors used compromised login credentials to gain illicit access to a Secure File Transfer Protocol (SFTP) server operated by ETS. Educational Testing Service administers statewide standardized testing assessments for California public schools, including the California Assessment of Student Performance and Progress (CAASPP) and the English Language Proficiency Assessments for California (ELPAC).

ETS identified the unauthorized file access on September 25, 2026, and notified school districts on October 2, 2026, before coordinating a public disclosure with the state. An internal investigation confirmed that intruders copied student files intermittently across a four-month window.

What Student Data Was Exposed in the Breach

The scope of exposed data varies by student, but involves records dating back through the 2023–2024 academic year:

Data Category	Exposed in ETS Breach?	Details
Basic Identifiers	Yes	Full student name, date of birth, home address, and school attended
Academic Identifiers	Yes	Statewide Student Identifier (SSID) and standardized test scores
Demographic & Special Records	Yes	Demographic profiles, disability records, and program eligibility files
Social Security Numbers	No	Confirmed not stored on the compromised SFTP server
Financial & Payment Data	No	No credit cards, banking data, or parent billing files were involved
Parent/Guardian Personal Data	No	Contact information and parent personal records were excluded

Because Social Security numbers were not taken, scammers cannot automatically establish traditional lines of credit overnight. However, bad actors frequently bundle basic demographic data with records from other breaches to assemble synthetic profiles or craft convincing spear-phishing schemes aimed at families.

Warning Signs of Child Identity Theft After the Breach

Data breach exposures involving children often manifest months after the initial intrusion. Watch for these indicators that an affected student’s personal information may be circulating among scammers:

• Unsolicited calls, texts, or emails claiming to be from ETS or school officials: Legitimate state agencies will not call or text asking for your child’s Social Security number or payment to receive breach protections.
• Credit offers and pre-approved cards addressed to a minor: Children rarely have credit files, so pre-approved cards, loan offers, or rewards enrollments indicate an active file exists.
• Government and agency notices in your child’s name: Warning letters from the IRS about unpaid taxes, notifications regarding state benefits, or jury duty summonses for a minor signal identity misuse.
• Calls from collection agencies: Debt collectors demanding payment for opened utility accounts, cell phone contracts, or medical services in a student’s name point to fraudulent accounts.
• School enrollment or testing discrepancies: Notifications from educational institutions regarding unauthorized transfers, unknown state test submissions, or modified student records.

How to Protect Yourself and Your Child

Take the following concrete defensive steps to protect your child’s personal data from being weaponized:

1. Activate the state-provided identity protection coverage. ETS is offering two years of complimentary identity monitoring through Experian IdentityWorks. Parents can enroll eligible minor children at Experian IdentityWorks for Minors using the activation code provided in the official CDE breach notification.
2. Place a credit freeze on your child’s credit file. Federal law allows parents and legal guardians to freeze a credit file for children under 16 at no cost to prevent unauthorized accounts from being opened. Contact each of the three credit bureaus (Equifax, Experian, and TransUnion) directly to request a minor freeze.
3. Apply a verification test to all breach-related outreach. Scammers exploit news of large breaches to pose as test administrators, district staff, or identity support agents. If someone contacts you seeking account verification, hang up and reach out through the official California Department of Education incident portal.
4. Monitor your household’s digital accounts. Update passwords across school portal logins, parent-teacher applications, and family email accounts, pairing each with multi-factor authentication (MFA) using an authenticator app.
5. Check for existing credit files for older dependents. Students who are 18 or older can review their own credit reports for free every week at AnnualCreditReport.com to ensure no accounts have been opened under their names.

What to Do If Your Child’s Information Was Misused

If an unauthorized party uses your child’s personal details to open accounts, secure credit, or claim benefits, take immediate action to limit liability:

• Halt contact and refuse demands for payment: Never send funds or negotiate with debt collectors attempting to collect on fraudulent debts opened in a child’s name.
• Contact the fraud departments of involved companies: Reach out to the bank, merchant, or utility provider that issued the fraudulent account, notify them of child identity fraud, and demand written confirmation that the account is closed and cleared.
• File an identity theft report with the FTC: Submit an official declaration at IdentityTheft.gov. This creates an official Identity Theft Report required by banks and credit bureaus to remove fraudulent records.
• Demand immediate credit file purges: Send copies of your FTC Identity Theft Report and proof of minor custody to Equifax, Experian, and TransUnion, requesting the immediate deletion of all fraudulent tradelines and inquiries.
• File a police report: Contact your local police department if financial fraud, impersonation, or extortion occurred, and retain the incident report number for your financial documentation.
• Maintain complete paper trails: Log all correspondence, including dates, representative names, case numbers, and copies of collection letters.

How to Report the Threat and Stay Protected

Reporting incidents promptly assists regulatory authorities and cybersecurity investigators in tracking down threat actors and stopping systemic abuse. Use these verified channels:

• Federal Trade Commission (FTC): Report identity theft and recover an identity through IdentityTheft.gov, or submit general fraud reports to the FTC Fraud Reporting Portal.
• FBI Internet Crime Complaint Center (IC3): File cybercrime and data breach reports via the IC3 Portal.
• California Department of Justice: Access identity theft resources and state breach updates via the Privacy Enforcement and Protection Unit.
• Federal Communications Commission (FCC): Report suspicious caller ID spoofing or phishing robocalls on the FCC Complaints Center.
• California Department of Education Support Line: Families with questions regarding the ETS breach notification can contact the CDE assistance line at 833-931-8488.

Safeguarding student records requires active vigilance. By placing credit freezes, enrolling in complimentary monitoring, and questioning unexpected communications, families can minimize the risks associated with school vendor data security incidents.

The post ETS California Student Data Breach: What Happened and How to Protect Your Child appeared first on McAfee Blog.