Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.
Microsoft and Health-ISAC, under an order from the US District Court for the Southern District of Florida, seized and redirected domains used by YAM Store, CoGUI, and Iron Man. Microsoft says those services sent more than one billion malicious messages since January 2026 to consumers and over 75,000 organizations in more than 150 countries, including over 750 million aimed at Microsoft customers. YAM Store, tracked as Storm-3119, resold compromised Microsoft 365 and Azure for Education tenants, while CoGUI, Haozi, and Iron Man are Storm-2990 phishing kits that harvest credentials and one-time codes. Microsoft disabled over 20,000 related accounts and is blocking more than 100,000 impersonation domains.
- Court order redirected domains used by YAM Store, CoGUI, and Iron Man.
- Services sent over one billion malicious messages since January 2026.
- More than 75,000 organizations in over 150 countries were targeted.
- Iron Man offered about 2,335 templates across 139 countries.
- Microsoft disabled over 20,000 accounts tied to YAM Store.
Full article610 words · extracted from securityweek.com · click to collapse
Microsoft and Health-ISAC have seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.
The action was based on an order from the US District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit after threat actors frequently leveraged the cybercrime infrastructure to target hospitals and healthcare organizations.
According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026. The messages targeted consumers and over 75,000 organizations in more than 150 countries, and over 750 million of them were aimed at Microsoft customers. The operators made tens of millions of dollars.
The company has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in the country. Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs later joined the effort, along with US and international law enforcement.
“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world. YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” wrote Steven Masada, general manager of Microsoft’s Digital Crimes Unit.
Advertisement. Scroll to continue reading.
YAM Store, CoGUI and Iron Man
Microsoft tracks YAM Store as Storm-3119. The marketplace sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google. Buyers could choose based on age, subscription type and environment type, such as education or nonprofit.
“YAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations, including the phishing kits tracked as Storm-2990,” Microsoft’s threat intelligence team explained.
The Storm-2990 phishing kits were sold on YAM Store, and they are called CoGUI, Haozi and Iron Man.
Microsoft assesses with high confidence that the kits were developed by Chinese-speaking threat actors. “The similarity in their infrastructure and overlap in activity suggest either shared development origins, code reuse, or close collaboration among their developers,” Microsoft said.
CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was increasingly being replaced by Iron Man, which YAM Store started advertising in June 2026.
Iron Man offers more than 2,335 templates tailored to over 139 countries, according to Microsoft. The US accounts for the largest number of templates, and most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees.
Beyond static lures, the kits function as live, interactive platforms for credential harvesting. This setup allows operators to monitor victims in real time and prompt them for one-time verification codes.
Resecurity, which bought an Iron Man license and ran the kit in an isolated lab, counted 2,360 templates covering 130 countries and areas. The newest was added on October 1.
The company found that the kit needs regular contact with the vendor’s licensing server to function. “This confirms the panel cannot operate without regular contact with vendor infrastructure — a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation,” Resecurity said.
Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Related: NightmareStresser DDoS Service Disrupted in International Operation