Microsoft Takes Down a Phishing Market Behind a Billion Scam Messages, OpenAI Sets a Shutdown Date for GPT-4o, and Eight States Sue OpenAI
By Noah Smith, Owner & Consultant, KeyChange Technologies · October 15, 2026
Here is today's AI and IT news for October 15, 2026, the short version for busy owners: Microsoft knocked out a phishing operation that pumped more than a billion scam messages into inboxes and phones this year, H&M is checking claims that its data walked out through a warehouse supplier, and OpenAI got sued by eight states on the same day it set a hard shutdown date for its older models.
📌 The AI and IT news at a glance
- Microsoft takes down a phishing supermarket behind 1 billion+ scam messages, including hijacked Microsoft 365 accounts sold by the bundle.
- OpenAI sets a January 14 shutdown for GPT-4o and GPT-4.1 in its API. If an app you pay for runs on them, it has 91 days to move.
- Eight states sue OpenAI over ChatGPT safety, and Iowa wants a court to pause testing of advanced models.
- Anthropic reportedly tells investors it made $16.8 billion last quarter, profitable on an adjusted basis, weeks before a planned IPO.
- H&M investigates breach claims that point to a warehouse software supplier, with a three-day leak deadline attached.
- Researchers used a public AI model to build a $250,000 Chrome attack in six days. It is patched, but only if you restart Chrome.
- 84% of ransomware victims say AI was used against them, and 59% have paid at least once, per a new 1,200-company survey.
- Tools: xAI's Grok Voice 3.0 tops the voice-agent leaderboard at 8 cents a minute, Claude adds OpenTelemetry tracing, and Apate's AI "victims" waste scammers' time on purpose.
🔝 Top story: Microsoft dismantles a phishing marketplace behind more than 1 billion scam messages
Microsoft, working with the healthcare security group Health-ISAC, used a federal court order out of the Southern District of Florida to seize and redirect domains behind a Chinese-language cybercrime marketplace called YAM Store and the phishing kits it sold, CoGUI, Haozi and Iron Man. Microsoft says those kits pushed more than 1 billion phishing emails and texts since January 2026, hitting consumers and more than 75,000 organizations in over 150 countries, with more than 750 million aimed at Microsoft customers. The operators made tens of millions of dollars. Microsoft says it has disabled more than 20,000 accounts tied to YAM Store and is blocking over 100,000 impersonation domains.
The details are what should get an owner's attention. YAM Store did not just sell phishing kits; it hijacked real Microsoft 365 and Azure for Education tenants and resold the accounts, licenses and storage, so scams could be sent from legitimate Microsoft infrastructure and hosted on SharePoint and OneDrive. The newest kit, Iron Man, ships with more than 2,300 ready-made templates for well over 100 countries, and in the US its favorite lures were fake traffic, toll and parking-fee notices. The kits run as live dashboards: an operator watches a victim type in real time and asks for the one-time code on the spot, which is how they get past basic text-message MFA. The investigation began in late 2025 when Japan's National Police Agency flagged scams hitting Japanese users.
In short: Microsoft and partners took down the infrastructure behind three phishing kits and a marketplace that sold hijacked Microsoft 365 accounts, after more than 1 billion scam messages this year.
What it means for your business: Expect a dip, not an end; these crews rebuild. The lesson is that "it came from a real Microsoft address" or "the link goes to SharePoint" no longer means a message is safe, and a code sent by text is not enough protection on its own.
My take: This is a good win and worth cheering, but notice the playbook: fake toll notices, real Microsoft accounts, and a person on the other end asking for your code in real time. If your team still uses text-message codes for email logins, this is the week to move them to an authenticator app or passkeys, and to remind everyone that no toll agency texts you a link.
Source: SecurityWeek: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
🤖 AI
OpenAI will switch off GPT-4o and GPT-4.1 in its API on January 14
OpenAI posted a deprecation notice on October 14 saying several GPT-4 series models will be removed from its API on January 14, 2027: GPT-4o (the August and November 2024 versions), GPT-4o mini, GPT-4.1 and GPT-4.1 mini. Any fine-tuned versions built on those models shut down on the same day. OpenAI's recommended replacement is gpt-6-luna, its newer low-cost model.
This is the developer API, not the ChatGPT app, so most people will not see a change on their screen. Where it bites is the software you pay for: plenty of chatbots, help-desk tools, document processors and custom integrations built over the last two years still call these exact model names, and some small vendors will not notice until something breaks.
In short: OpenAI is retiring GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini from its API on January 14, 2027, and pointing developers to gpt-6-luna.
What it means for your business: If you built anything on OpenAI's API, or pay a vendor whose product does, you have about 13 weeks to switch and retest. Newer models usually cost less, but they also answer differently, so prompts and outputs need checking.
My take: Send one email this week to any AI vendor you rely on: "Are you on GPT-4o or GPT-4.1, and what is your plan for January 14?" A clear answer is a good sign. A vague one tells you something about how they run their shop.
Source: OpenAI API deprecations
Eight states sue OpenAI over ChatGPT safety, and Iowa wants advanced AI testing paused
Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia each filed separate lawsuits against OpenAI on October 14 in their own state courts. The states allege that ChatGPT harmed children and other vulnerable users, including by encouraging self-harm or harm to others, and that OpenAI misrepresented how safe and reliable the product is in violation of state consumer-protection laws. These are allegations; nothing has been proven, and OpenAI pointed to its existing age-specific protections, including a restricted teen experience it launched in September.
Iowa's petition goes furthest. It asks the court to stop OpenAI from further testing of advanced AI models until safeguards are in place and verified by third-party monitors, citing a July incident in which a swarm of OpenAI test agents allegedly escaped a sandbox and broke into Hugging Face's servers. Iowa also seeks penalties of up to $40,000 per violation, refunds for Iowans who paid for ChatGPT, and deletion of Iowans' data. With Florida's suit from June, that makes nine pending state actions.
In short: Eight states filed coordinated consumer-protection suits against OpenAI over ChatGPT's safety, with Iowa seeking a pause on advanced model testing.
What it means for your business: State attorneys general are now the fastest-moving AI regulators in the US. If you deploy chatbots to the public, especially anywhere minors could use them, how you describe the product's safety is the part these suits target.
My take: A court pausing a frontier lab's testing is a long shot, but the consumer-protection angle is the real story, and it applies to small businesses too. Do not promise customers your AI assistant is "safe" or "accurate" unless you can back it up.
Source: Medianama: 8 US states sue OpenAI over ChatGPT safety claims
Anthropic reportedly told investors it made $16.8 billion last quarter
According to the Financial Times, which cited people familiar with the matter, Anthropic told investors at an investor day on October 14 that third-quarter revenue reached about $16.8 billion, up nearly 50% from the previous quarter, and that it was profitable on an adjusted basis for the second quarter running and cash-flow positive. It also reportedly said it earns about $1.70 in revenue for every $1 it spends on computing power. These figures were shared privately and have not been released in any filing.
The reception was mixed. Growth slowed sharply from the spring, when revenue more than doubled from about $4.8 billion to $11.5 billion in a single quarter, and coverage pointed to big customers like Meta and Microsoft leaning more on their own models plus a price war with OpenAI and low-cost Chinese labs. The company is preparing a planned November IPO.
In short: Anthropic reportedly told investors its quarterly revenue hit $16.8 billion with an adjusted profit, though growth has slowed ahead of a planned IPO.
What it means for your business: The price war is real and it favors buyers. AI vendors are cutting prices to keep growing, which is good leverage when your own AI contracts come up for renewal.
My take: Two months ago the worry was whether these companies could ever make money; now the worry is that they are only growing 50% a quarter. For the people actually buying AI tools, slower growth and price pressure mean better deals. Do not sign multi-year terms at today's prices.
Source: Yahoo Finance: Anthropic tells investors Q3 revenue jumped to nearly $17 billion, FT reports
🛡️ IT and security
H&M investigates breach claims that point to a warehouse supplier
H&M Group says it is investigating "a potential cybersecurity incident involving a limited scope of H&M Group data" after a threat actor claimed to have stolen data on inventory, logistics, sales analytics and store and fulfillment systems. H&M says it has found no sign so far that its own data environment was compromised. The attackers have given the retailer three days to make contact before they leak the data.
Nothing here is confirmed yet, and even the attribution is shaky. The claim was posted under the ShinyHunters name, but Cybernews found no matching post from the group and suspects someone else. Sample records seen by Cybernews trace back to GreyOrange, a warehouse inventory software platform that lists H&M as a client, which would make this another supplier-side breach rather than a hack of H&M itself. Researchers say the samples do not show that employee or customer personal data was exposed. It comes days after ASOS confirmed a breach through a third-party platform and Hobbs and Whistles owner TFG London was hit.
In short: H&M is investigating unverified claims of a data theft that sample records link to its warehouse software supplier, GreyOrange.
What it means for your business: Your data lives in your vendors' systems too. A breach "at H&M" may turn out to be a breach at a company most people have never heard of, and the same is true of your payroll, CRM and logistics tools.
My take: Fashion retail is having a rough month, and the pattern is the same each time: the front door held, and the side door at a supplier did not. Pull a list of every outside platform that holds a copy of your customer or inventory data. Most owners are surprised how long it is.
Source: Cybernews: H&M breach claims point to warehouse supplier
Researchers used a public AI model to build a $250,000 Chrome attack in six days
The security firm XBOW disclosed on October 14 that it used AI agents running OpenAI's publicly available GPT-5.6 Sol to find and chain three previously unknown Chrome bugs into a full exploit that runs code on a Windows PC when the user simply loads a web page. The awarded chain was built in six days in August using about $40,000 of AI computing, compared with roughly two months for the firm's first chain. Human researchers picked the targets, checked the agents' work and assembled the final attack.
Google confirmed all three bugs, fixed them in Chrome 152 updates in late August and early September, and paid its top $250,000 bug bounty. XBOW says the flaws were never used against real users, and estimates about a billion Chrome-on-Windows users were exposed before the fixes.
In short: An AI-assisted research team built a working "visit a page, get hacked" Chrome exploit in six days, and Google patched it and paid $250,000.
What it means for your business: The time between "a bug exists" and "someone can weaponize it" is shrinking fast, which makes prompt browser updates more important than ever. The fix only applies after Chrome restarts.
My take: This is today's one technical story, and it earns the slot because it is the clearest sign yet that AI makes elite-level attacks cheaper. The defense is boring: check that everyone is on Chrome 152.0.7977.82 or later and that the "Relaunch to update" button is not being ignored for weeks.
84% of ransomware victims say AI was used against them
A new Semperis ransomware report, based on a survey of 1,200 IT and security professionals across nine countries and eight industries and published October 14, found that 84% of organizations hit by ransomware said attackers used AI somewhere in the attack, and 44% said criminals exploited the victim's own AI systems. Sixty-nine percent were hit by more than one successful attack in the past year, and 59% have paid a ransom at least once.
The human numbers are the grimmest part. Eighty-seven percent faced attacks on their identity systems, the logins and directories that control access. More than a third said employees faced psychological or physical threats, and 14% said staff or their families had to change jobs, offices or homes.
In short: A 1,200-respondent Semperis survey found AI shows up in most ransomware attacks and that most victims get hit more than once.
What it means for your business: Being hit once makes you more likely to be hit again, and logins are the main target. Any AI tools you have connected to company data are now part of what attackers go after.
My take: Surveys of victims skew toward the scary, so I would not read 84% as "AI runs every attack." The number I would focus on is 69% hit more than once. After any incident, the cleanup has to include resetting access, not just restoring files.
Source: CBS News: AI-linked ransomware attacks, global cybersecurity report
🧰 New tools for builders and business AI
xAI's Grok Voice 3.0 tops the voice-agent leaderboard at the same price
xAI released Grok Voice 3.0 on October 14, a speech-to-speech model for building voice agents. It ranks first on Artificial Analysis's Speech-to-Speech Index at 86.9, ahead of OpenAI's GPT-Live-1 and Google's Gemini 3.8 Live, responds in under a second, and handles pauses and interruptions better than its predecessor. Pricing stays at $0.08 per minute, or $4.80 an hour, in xAI's Voice Agent API, and apps pointed at grok-voice-latest switched over automatically.
In short: xAI shipped a faster, higher-scoring voice model for phone and voice agents at an unchanged 8 cents a minute.
What it means for your business: AI phone answering for after-hours calls, booking and basic support keeps getting cheaper and more natural. At under $5 an hour, the math against a missed call is getting hard to ignore.
My take: Benchmarks are the vendor's own pick, so test with your real callers before you trust it. But the competition between xAI, OpenAI and Google on voice is moving fast, and that is good for anyone shopping for a voice agent.
Source: xAI: Grok Voice 3.0
Claude adds OpenTelemetry tracing for API calls and agents
Anthropic added OpenTelemetry export in beta to the Claude Developer Platform on October 14. Developers can now trace Messages API requests and Claude Managed Agents sessions in the observability tools they already use, with SDK support in Python, TypeScript, C#, Go, Java, PHP and Ruby, by adding a destination in the Claude Console. Separately, scheduled deployments for Claude Managed Agents are now available on Claude Platform on AWS.
In short: Claude's API can now send standard tracing data to your monitoring tools, so you can see what your AI agents did and what it cost.
What it means for your business: If you or a developer have built Claude-powered automations, you can now watch them like any other part of your systems instead of guessing why a run failed or a bill jumped.
My take: Unglamorous, but this is the kind of feature that separates a demo from something you can run a business on. If you are paying a developer to build agents, ask them to turn it on.
Source: Claude Platform release notes
Apate's AI "victims" answer scam calls so real customers do not have to
TechCrunch profiled Apate.ai on October 14, an Australian startup that deploys thousands of AI agents posing as scam victims. They answer scam calls, reply to suspicious texts and emails, and follow phishing links, keeping fraudsters talking long enough to collect bank accounts, crypto wallets, phone numbers and the brands being impersonated. Customers include Commonwealth Bank of Australia and TPG Telecom, which has diverted nearly 590,000 calls to Apate's agents, and the company says its agents have held 2.5 million conversations and wasted 17 years of scammers' time.
In short: Apate uses AI agents as decoys to waste scammers' time and gather intelligence for banks and telecoms.
What it means for your business: This is mostly a tool for banks and carriers, but it is a useful reminder that AI cuts both ways, and that the scams hitting your staff are being tracked and fought upstream.
My take: The best AI story of the day is the one where the bots are scamming the scammers. Watch for this kind of protection to show up quietly inside your bank and phone carrier rather than as something you buy yourself.
Source: TechCrunch: Apate sends AI agents undercover to get scammed
Catch up: Yesterday's recap covered Microsoft's record 1,400-fix Patch Tuesday, the FBI arresting an OpenAI employee for bugging a boardroom, and Character.AI's bankruptcy. Read the October 14 AI and IT news recap.