Microsoft and Health-ISAC seize domains behind YAM Store, CoGUI and Iron Man phishing platforms tied to over a billion messages

· CyberSecurity

TLDR

  • Microsoft and Health-ISAC won a US court order to seize domains behind YAM Store, CoGUI and Iron Man cybercrime services.123
  • The services sent more than one billion malicious messages since January 2026, according to Microsoft.123
  • The action hits phishing's supply side, brokers and kits, which Microsoft says are part of a larger criminal network.2

The investigation began in late 2025 when Japan's National Police Agency alerted Microsoft to messaging campaigns targeting people in Japan, which led investigators from CoGUI to YAM Store.23 CoGUI was used heavily against victims in Japan and the United States before Iron Man, which YAM Store began advertising in June 2026, largely replaced it.12 Microsoft says Iron Man offers more than 2,300 templates tailored to over 139 countries, with US lures mostly impersonating transportation and government bodies such as traffic and parking authorities, and assesses with high confidence that the kits were built by Chinese-speaking actors.12

According to BleepingComputer, the operators bought expired domains of real organisations and rebuilt their websites to look active, in some cases invented organisations using AI tools, and used those identities to obtain cloud accounts; in compromised Microsoft environments they abused SharePoint and OneDrive for hosting.1 Many of the messages used device-code phishing to steal authentication tokens, and the kits included geofencing, fake CAPTCHA gates and IP filtering to hinder analysis.1 Resecurity, which took part in the investigation, found an exposed Git and container registry with 911 published builds and catalogued 2,360 phishing packages covering 130 countries and areas.1

Why it matters: the action targets the supply side of phishing, the brokers and kits that hand criminals aged domains and legitimate cloud tenants that look legitimate, which Microsoft's Digital Crimes Unit describes as only part of a larger criminal network.2

Sources

  1. Global takedown hits network behind 1 billion phishing messages (BleepingComputer)
  2. Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages (SecurityWeek)
  3. Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals (The Record)