Microsoft has identified a network of phishing suppliers that accept Tether (USDT) as payment, and linked the tools those suppliers provide to campaigns used against as many as 75,000 organizations. The finding puts a spotlight on how criminal service providers are using stablecoins to get paid, and how that payment model helps fuel phishing attacks at industrial scale.
What Microsoft found about the USDT-accepting phishing suppliers
According to Microsoft, the identified parties operate as suppliers in a phishing-as-a-service model. That means they are not necessarily running every attack themselves. Instead, they sell or lease ready-made phishing tools to other criminals who carry out the actual campaigns. For related coverage, see AINext Awards & Conference Singapore 2026: Where AI Leaders, Innovators and Decision-Makers Shape the Future of Artificial Intelligence.
One reported characteristic of these suppliers is that they accept USDT, the US dollar-pegged stablecoin issued by Tether, as a form of payment. A stablecoin is a cryptocurrency designed to hold a fixed value, in this case one US dollar per token. Accepting USDT allows suppliers to receive payment without touching traditional bank accounts, which can be harder for investigators to trace than conventional wire transfers. For related coverage, see Charles Schwab Adds Direct Bitcoin and Ether Trading.
It is important to note that USDT acceptance is one reported attribute of these specific suppliers. It does not mean that ordinary USDT transactions are suspicious, and Tether itself is a widely used financial tool with legitimate applications. Microsoft’s finding concerns a specific criminal marketplace, not cryptocurrency payments broadly. This pattern is consistent with earlier research, including Microsoft’s prior warning about crypto malware campaigns that evolved from simple theft tools into more sophisticated backdoors. For related coverage, see Mizuho, MUFG and SMBC Complete Yen Stablecoin Pilot.
How the phishing tools connect to 75,000 organizations
Microsoft reported that the phishing tools supplied by the identified parties were used against as many as 75,000 organizations. The figure describes potential campaign reach, meaning organizations that were targeted or exposed to attacks using these tools, not necessarily organizations that were fully compromised.
The distinction matters. Being targeted by a phishing campaign does not automatically mean an organization’s accounts or data were accessed. The scale of 75,000 organizations does, however, illustrate how widely a supplier model can spread attack capability. A small number of suppliers can enable a far larger number of campaigns run by separate criminal operators who purchase or rent the tools.
Microsoft has not publicly detailed which industries or regions these 75,000 organizations belong to based on the available information. Inferring geography, sector breakdown, or confirmed victim counts beyond what Microsoft attributed would go beyond what the evidence supports.
What this means for organizations and crypto users
The finding highlights how phishing-as-a-service marketplaces operate similarly to legitimate software-as-a-service businesses, with suppliers, customers, and payment rails. Cryptocurrency, and stablecoins in particular, can appear as a payment method in these illicit marketplaces because transactions can cross borders quickly and outside the traditional banking system.
For organizations, the practical response is the same regardless of how suppliers get paid. Verify the sender before clicking any link in an email or message. Check that login pages use the correct domain. Enable phishing-resistant multi-factor authentication, which requires a physical key or device confirmation rather than a code sent by text message. Report suspicious messages to your IT or security team rather than dismissing them.
For anyone who uses USDT or other stablecoins, Microsoft’s finding is a reminder that cryptocurrency payment rails are part of the modern criminal economy, even though the vast majority of stablecoin activity is legal. Awareness of how these markets work helps ordinary users understand why security researchers and law enforcement are paying close attention to on-chain payment patterns connected to cybercrime. Related Microsoft security research has previously shown how cryptocurrency theft tools can evolve into persistent threats for both individuals and organizations.
If you receive an unexpected login request, a message urging you to verify credentials, or an email asking you to click a link to secure your account, treat it with caution. These are common delivery mechanisms for the kind of phishing campaigns Microsoft’s research describes.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
