There is something almost darkly impressive about the efficiency of modern cybercrime.
Microsoft’s Digital Crimes Unit recently helped disrupt three interconnected services—YAM Store, CoGUI and Iron Man—that formed part of a sprawling cybercrime marketplace. Since January 2026, Microsoft says the services collectively enabled more than one billion malicious messages targeting more than 75,000 organizations across over 150 countries. One of the services, Iron Man, offered more than 2,300 ready-made templates for impersonating banks, retailers, healthcare providers, government agencies, police departments, transportation authorities and other trusted organizations. Microsoft’s Digital Crimes Unit investigation
This was not simply a collection of people painstakingly crafting fraudulent emails one at a time. Customers could buy accounts, infrastructure, fake websites, online identities and impersonation tools designed to make criminal activity faster and easier to deploy. Microsoft described YAM Store as operating much like an online shop, where customers could browse products and purchase the ingredients needed to conduct fraud.
Cybercriminals can increasingly walk into the metaphorical IKEA of digital fraud, pick out a convincing bank, an official-looking government agency and perhaps a nice little parcel-delivery scam to complete the room. Everything comes flat-packed. Some assembly required. (Watch out for extra screws).
What happens when the malicious message looks like something you are supposed to trust?
For many years now (too many?!) cybersecurity awareness programs have taught people how to identify suspicious communications. Look for strange domains. Check the logo. Watch for spelling mistakes. Be wary of unusual formatting. Hover over the link. Slow down when something looks wrong.
Those are still useful habits. What has changed is how cheaply and convincingly attackers can manufacture deception at scale. The goal is still familiar—steal money, gain access, capture credentials, manipulate a transaction—but the path to that goal can now include remarkably polished impersonation, context that feels specific to the recipient, and spearphishing techniques deployed at volumes that once would have required far more time, skill and manual effort.
A supplier request might arrive using familiar branding and plausible language. A payment instruction can resemble the dozens of legitimate requests an accounts-payable employee handles every week. An account notification might reproduce the exact visual patterns employees have learned to associate with Microsoft, Google, their bank or another trusted provider. The message may appear during an otherwise ordinary workday, inside a business process where taking action is not unusual at all.
Microsoft’s investigation is interesting because it exposes the machinery behind that illusion of legitimacy. CoGUI supplied ready-made sites and messages impersonating trusted organizations. Iron Man expanded the model with thousands of templates tailored across brands, industries, countries and languages. YAM Store provided accounts and infrastructure that could be combined with those services.
The appearance of credibility is becoming a commodity.
The security question is becoming less about spotting the fake and more about verifying the real
Imagine you work in finance and receive an email asking you to update a supplier’s bank information.
There are two ways we might think about the risk.
The traditional awareness question is: Can the employee recognize that this email might be fraudulent?
A more useful operational question is: What happens next?
The financial consequences of getting that decision wrong are not theoretical. The FBI’s 2025 Internet Crime Report recorded approximately $568 million in reported Business Email Compromise losses during the year, illustrating why payment, supplier and executive-authority workflows remain attractive targets for attackers. FBI Internet Crime Report
Does the organization have a defined process for changing supplier banking details? Does that process require independent verification? Does the employee know how to perform it? Can they reach the right person quickly? Are they allowed to delay the transaction? Would challenging a senior executive’s instruction create social friction? Does the process change if the request appears to come from someone the employee knows? What happens when the employee is handling fifteen other urgent tasks at the same time?
These are very different questions from whether somebody remembers the warning signs of phishing. They are questions about verification behavior, business process design, authority, escalation and organizational culture.
That distinction matters because employees do not make cybersecurity decisions in laboratories. They make them while doing their jobs.
Human risk lives inside business processes
One of the persistent weaknesses in traditional security awareness is the tendency to isolate the human decision from the environment in which it occurs.
We test whether someone clicks a simulated phishing link. We give them a score. We assign some training. (Perhaps we congratulate ourselves when the click rate drops.)
But an accounts-payable employee is not primarily engaged in the activity of “avoiding phishing.” They are processing payments. A help-desk employee is trying to restore access. A recruiter is communicating with candidates. An executive assistant is coordinating meetings, documents and requests from senior leaders. A customer-service representative is helping people solve problems quickly.
The security behavior exists inside that work.
The broader breach data continues to support the relevance of this problem. Verizon’s 2026 Data Breach Investigations Report continues to identify phishing, social engineering, credential abuse and other forms of human involvement as important features of the breach landscape even as vulnerability exploitation, ransomware and AI-assisted attacks evolve alongside them. Verizon 2026 Data Breach Investigations Report
Meaningful human risk analysis has to understand the process surrounding the decision: what the employee is trying to accomplish, what systems and information they are using, what authority the other party appears to possess, what verification mechanisms exist, what pressures influence the decision and what consequences follow if they get it wrong.
That is the trust architecture around the human decision.
Verification is an organizational capability
Security teams regularly tell employees to “verify suspicious requests.” But verification only works as a security control when the organization makes it possible to perform.
Even basic anti-fraud guidance increasingly reflects this principle. The Federal Trade Commission advises people who receive a questionable request to contact the supposed sender using contact information they independently know to be legitimate, rather than relying on a phone number, email address or link supplied in the suspicious communication itself. Federal Trade Commission guidance on impersonation scams
Consider a request apparently coming from a senior executive asking for an urgent payment. The employee might understand perfectly well that unusual payment requests should be verified. But what constitutes verification? Replying to the same email certainly does not. Calling the phone number included in the request may not. Messaging the executive through another internal channel might help, unless that account is also compromised.
The organization needs a known and usable verification path, and even more importantly, the employee needs permission to use it.
There is a cultural dimension to this that security technology cannot solve by itself.
Employees must believe they are allowed to question authority, slow down a process, challenge an unusual instruction and escalate uncertainty without being punished for creating inconvenience.
That is where something often discussed as “security culture” becomes very concrete.
A speak-up culture is not a poster reminding employees that security is everyone’s responsibility. It is an operating condition in which a junior employee can say, “I know this request appears to come from the CFO, but I need to verify it before I proceed,” and the organization regards that interruption as the control working exactly as intended.
A stronger human risk program asks whether the control will hold under pressure
This also changes what organizations should measure. Knowing whether employees understand phishing remains useful. Knowing whether they can identify obvious suspicious messages remains useful. Completion data, simulation data and knowledge assessments all provide pieces of the picture.
They just do not tell us whether the organization will withstand a convincing impersonation attempt inside a high-risk business process.
For that, we need to examine behavior in context.
Can employees identify when independent verification is required? Do they actually perform it? Do they choose an appropriate verification method? Do they escalate when verification fails? Does performance change under urgency or apparent authority? Are certain teams, roles or workflows consistently more exposed than others?
And when people make the wrong decision, we should resist immediately concluding that the employee is “the problem.” (!!)
Sometimes the employee lacks knowledge. Sometimes the procedure is unclear. Sometimes the technology makes the safe action difficult. Sometimes incentives favor speed over caution. Sometimes authority gradients discourage challenge. Sometimes the expected secure behavior has never actually been defined.
Those are materially different risk conditions, and they require different interventions.
The attacker is industrializing. Defense needs to become equally systematic.
Microsoft’s operation offers a useful glimpse into the economics of modern fraud.
The individual scam message may be the part we see, but behind it sits an interconnected supply chain of accounts, domains, infrastructure, templates and specialist services. Microsoft’s investigation connected activity that initially appeared separate and helped expose a broader service economy supporting criminal operations across borders.
Attackers are reducing the amount of specialist expertise required to launch convincing attacks.
The consequences of industrialized impersonation are visible well beyond enterprise email. Federal Trade Commission data released in 2026 found that people reported approximately $3.5 billion in losses to impersonation scams during 2025, with impersonation accounting for nearly one in three fraud reports received by the agency. Reported losses were almost three times the level seen in 2020. FTC data on impersonation scams
Organizations should think carefully about the defensive equivalent. If the answer to every new impersonation technique is simply another warning email telling employees to “be extra vigilant,” the economics are not favorable. Attackers are building reusable systems while defenders are issuing reminders.
A more resilient approach builds repeatable capabilities too: clear verification procedures, risk-based process controls, role-specific learning, realistic scenarios, usable escalation paths, behavioral measurement and feedback loops that reveal where the system is failing.
Organizations need to industrialize resilience.
AI will make the trust problem harder, but the underlying problem is already here
It is important not to overstate what Microsoft found. The YAM Store, CoGUI and Iron Man investigation is primarily a story about industrialized cybercrime infrastructure and impersonation services, not evidence that every attack involved generative AI.
But it is difficult to look at this ecosystem without considering where impersonation is heading.
Generative AI lowers the cost of producing convincing language, while synthetic voice and video increasingly complicate assumptions about identity. This is no longer hypothetical. In 2025, the FBI warned about a malicious campaign impersonating senior U.S. officials using text messages and AI-generated voice messages to establish credibility before attempting to gain access to accounts. FBI warning on AI-generated voice impersonation
AI systems can also help attackers customize communications, translate content and adapt scams to different audiences. Meanwhile, organizations themselves are beginning to introduce AI agents into workflows where humans may increasingly receive instructions, recommendations and actions mediated through automated systems.
The problem therefore expands beyond determining whether a message “looks real.” Organizations increasingly need to answer three different questions:
-
Is this person or system who it claims to be?
-
Is this instruction legitimate?
-
Am I authorized to act on it in this context?
Those questions matter for phishing and Business Email Compromise today. They will matter even more as human and machine actors become intertwined across enterprise workflows. The security principle underneath them is remarkably stable: trust should not depend solely on appearance.
Human resilience is what happens when the message gets through
Security teams should absolutely continue investing in technical controls that block malicious infrastructure, detect suspicious communications and disrupt criminal networks. Microsoft’s operation itself demonstrates why that work matters. The company says it has disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud.
But mature security programs also have to assume that some convincing requests will reach people.
Some will arrive at exactly the wrong moment. Some will appear to come from trusted organizations. Some will exploit legitimate business relationships. Some will target people whose jobs require them to respond quickly. The objective cannot be to create employees who distrust everything. Modern organizations would stop functioning.
The objective is to create people and processes capable of applying the right amount of trust, verification and challenge at the right moment.
That requires more than awareness. It requires understanding where consequential trust decisions occur across the workforce, identifying the behaviors that reduce risk, designing environments that support those behaviors and measuring whether the resulting controls actually work.
Criminals can buy credibility. Organizations have to engineer trust.
The most important lesson from Microsoft’s investigation may not be the extraordinary volume of malicious messages.
It is what sits behind them.
A mature criminal marketplace is increasingly capable of packaging the appearance of legitimacy and selling it as a service. Accounts, infrastructure, websites and recognizable identities can be assembled into convincing experiences designed to exploit the assumptions people normally use to navigate digital life.
That leaves organizations with a choice. We can continue asking employees to get better at spotting increasingly sophisticated fakes. Or we can start asking a larger question:
How should trust actually work inside our organization when appearances can no longer be trusted?
That question leads us somewhere much more useful.
It leads to verification. It leads to business process controls. It leads to behavioral risk. It leads to culture, escalation and speak-up behavior. It leads to understanding not only whether employees know what they should do, but whether the organization has created the conditions in which they can actually do it.
The organizations that handle this well will not be the ones with the most convincing posters, the lowest phishing click rate, or the longest list of warning signs employees are expected to remember. They will be the ones that know where trust decisions happen, where authority can be abused, which workflows are exposed, how verification is supposed to work, and whether people can actually use those controls when the pressure is on.
That is the standard the next generation of human risk programs should be built to meet.
How Cybermaniacs works on this problem
This is the territory Cybermaniacs works in every day.
We help organizations understand where human risk exists, why it exists, and what to do about it. That often starts with measurement. Our Human Risk Assessment and Baseline services look beyond completion data and phishing clicks to examine behavior, culture, policy understanding, psychology, and the organizational conditions that influence whether people can act securely in practice. In one global manufacturing engagement, a Human Risk Baseline helped surface meaningful differences across regions, functions, behavioral factors, and cultural conditions that conventional training data had not revealed. Read the global workforce Human Risk Baseline case study.
From there, we work with security teams on the operating model around the risk. Our Human Risk Management advisory services help organizations build the strategy, governance, measurement, segmentation, interventions, and operating cadence needed to manage human risk as an ongoing business capability. That can mean identifying high-risk populations, designing better verification and escalation behaviors, strengthening a speak-up culture, building role-based programs, or determining where process and organizational conditions are making secure behavior harder than it needs to be.
Learning still matters, but it works best when it is connected to the risks people actually face. Our Cyber Learning Experience uses continuous, behavior-focused learning to build competence and reinforce safer decisions over time. For organizations that need to keep particular risks visible between learning moments, our Cybersecurity Content as a Service supports ongoing campaigns, communications, and targeted interventions around the threats and behaviors that matter most.
One of our core principles is that people should not be treated as defective security controls waiting to fail. Secure behavior is shaped by knowledge, confidence, culture, workflow, authority, technology, incentives, and the environment in which a decision has to be made. When something goes wrong, the useful question is rarely just who clicked? It is what made that decision likely, what the organization expected the person to do instead, whether that behavior was realistically possible, and what needs to change so the same conditions do not keep producing the same result.
That is also why we connect measurement to action. A Human Risk Baseline for a global financial services organization surfaced differences in reporting behavior, authority, policy understanding, and organizational culture that required very different responses from another round of generic training. A regional bank used the same broader approach to move from awareness activity toward a structured human risk program with clearer governance, measurement, and prioritization. Read how the bank built its Human Risk Management program.
As impersonation becomes cheaper, more convincing, and more contextual, that connection between insight, behavior, process, and culture becomes even more important. The technology of deception will continue to improve. Organizations need to know that their people and processes can still make good decisions when it does.
