YAM Store (Product): news timeline & CVEs

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.

Microsoft, Health-ISAC, and partners disrupted the CoGUI phishing kit plus related YAM Store and Iron Man fraud infrastructure, seizing domains after a civil lawsuit in the Southern District of Florida. Proofpoint says CoGUI alone generated more than 100 million malicious emails a month, while Microsoft cited more than one billion messages targeting over 75,000 organizations since January 2026. Related kits CoAceV and CoFish_Ws share roots and mainly target Japan, impersonating brands such as Amazon, Apple, PayPay, and Rakuten to steal credentials and card data. Proofpoint recorded 1,081 CoGUI campaigns and about 17,000 unique domains across the three kits.

GBHackersupdated Oct 16, 11:26 UTC · 17h agofirst Oct 16, 08:54 UTC · 20h agoPhishing & fraud in the wild 13 sources2· 1 read

Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals

Microsoft disrupted three Chinese phishing platforms that enabled more than 750 million impersonation messages.

Microsoft said a U.S. court order let it seize and redirect domains supporting YAM Store, CoGUI, and Iron Man, phishing platforms used by Chinese cybercriminals. Since January the three services collectively enabled more than 750 million malicious messages aimed at Microsoft customers, impersonating over 75,000 organizations in more than 150 countries to steal credentials and financial data. Iron Man offered more than 2,300 lure templates, while YAM Store sold access to compromised or fraudulently obtained Microsoft and Google environments, including education and nonprofit accounts. Microsoft disabled more than 20,000 related accounts and is blocking over 100,000 impersonation domains, working with Japan's National Police Agency, Health-ISAC, and Resecurity.

The RecordOct 14, 13:18 UTC · 2d agoPhishing & fraud in the wild1· 1 read

Global takedown hits network behind 1 billion phishing messages

Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.

Microsoft, Japan’s National Police Agency, and partners disrupted YAM Store (Storm-3119) and phishing kits CoGUI, Haozi, and Iron Man, tracked as Storm-2990. The ecosystem is linked to more than a billion malicious email and SMS messages aimed at over 75,000 organizations in 150 countries, including over 750 million messages to Microsoft customers, many using device-code phishing. Operators bought expired domains, built fake organizations with AI, and abused SharePoint and OneDrive. Under a Southern District of Florida order, Microsoft seized related domains, deactivated over 20,000 accounts, and blocked 100,000 impersonation domains.

BleepingComputerupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:12 UTC · 2d agoPhishing & fraud in the wild 13 sources

YAM Store

Timeline3 articles

Appears with

Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month

Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals

Global takedown hits network behind 1 billion phishing messages