Microsoft Disrupts Chinese Phishing Market Behind 1B+ Messages
Backed by a federal court order, Microsoft and Health-ISAC have seized and redirected domains used by the YAM Store marketplace and associated phishing kits.
Radwan AbdulhadiEditor and technology writer
Court-Ordered Disruption Targeting Phishing Infrastructure
Microsoft and Health-ISAC have successfully seized and redirected domains utilized by YAM Store, CoGUI, and Iron Man. These platforms formed core components of a Chinese-language cybercrime marketplace that supplied malicious actors with accounts, specialized phishing kits, and infrastructure. The enforcement action was authorized by an order issued from the US District Court for the Southern District of Florida.
Health-ISAC joined the civil lawsuit after threat actors repeatedly weaponized this cybercrime infrastructure to target hospitals and critical healthcare organizations. According to telemetry from Microsoft, the combined services were leveraged to dispatch more than one billion malicious messages since January 2026, generating tens of millions of dollars in illicit revenue for the operators.
Global Scale and Multi-Agency Investigation
The massive wave of malicious outreach targeted ordinary consumers alongside more than 75,000 organizations across over 150 countries. Out of the total volume, more than 750 million messages were specifically aimed at Microsoft customers. In response, Microsoft has successfully disabled over 20,000 accounts directly tied to the YAM Store network and is actively blocking upwards of 100,000 distinct domains used for impersonation and fraud.
The extensive investigation into the network began in late 2025, when Japan’s National Police Agency alerted Microsoft to localized messaging campaigns targeting individuals within the country. As the scope expanded, a coalition of security companies and law enforcement agencies joined the effort, including Cloudflare, Oracle, Proofpoint, and TRM Labs.
Commenting on the broader impact of the operation, Steven Masada, general manager of Microsoft’s Digital Crimes Unit, wrote about how local scam activity uncovered a global underground service economy.
YAM Store Functioning as an Access Broker
Microsoft tracks the YAM Store marketplace under the threat group designation Storm-3119. The market specialized in selling infrastructure built upon compromised or fraudulently obtained cloud environments acquired from major providers including Microsoft and Google. Buyers could selectively purchase environments categorized by age, specific subscription types, and tenant classifications such as education or nonprofit sectors.
According to Microsoft’s threat intelligence team, YAM Store essentially functioned as an access broker. It acted as an intermediary that hijacked Microsoft 365 and Azure for Education tenants, subsequently reselling the stolen accounts, licenses, and storage capacities as a service to downstream criminal operations, including the deployment of Storm-2990 phishing kits.
CoGUI and Iron Man Phishing Kits
The Storm-2990 phishing kits distributed through the YAM Store marketplace were identified as CoGUI, Haozi, and Iron Man. Microsoft assesses with high confidence that these kits were engineered by Chinese-speaking threat actors. Strong similarities in underlying infrastructure and active code reuse point toward shared development origins or close collaboration among the developers.
While CoGUI was heavily deployed against victims in Japan and the United States, it was increasingly phased out by mid-2026 in favor of Iron Man, which YAM Store began aggressively advertising in June 2026. Iron Man featured over 2,335 customized templates tailored to more than 139 countries.
Independent analysis published when Resecurity said that the Iron Man platform required constant communication with vendor licensing servers provided crucial insights into how defenders could disrupt these active operations.
Real-Time Credential Harvesting and Global Impact
The Iron Man and CoGUI kits went beyond static credential lures, functioning as live, interactive platforms designed specifically for real-time credential harvesting. This advanced setup allowed operators to monitor targeted victims in real time and dynamically prompt them for multi-factor authentication or one-time verification codes during an active session.
Within the United States—which accounted for the highest concentration of templates—most lures impersonated transportation and government entities, such as local authorities handling traffic violations and parking fees. The dismantling of YAM Store, CoGUI, and Iron Man significantly degrades the tools and infrastructure required by transnational cybercriminals to scale their global operations.
Sources
- SecurityWeekMicrosoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Continue chronologically
Related entity coverage
Related stories
Microsoft and Japan Take Down Giant Phishing Network
Microsoft and Japan's National Police Agency have dismantled a major cybercrime marketplace behind over a billion phishing messages worldwide.
Global Law Enforcement Takedown Hits Phishing Network
Law enforcement and global partners disrupt a massive cybercriminal ecosystem responsible for over one billion malicious phishing messages.
Microsoft Disrupts EvilTokens Phishing-as-a-Service Platform
Microsoft's Digital Crimes Unit has disrupted the EvilTokens phishing platform, which compromised 12,000 accounts across 10,000 global organizations.
Major AI firms back new multi-company web scraping opt-out standard
OpenAI, Google, Microsoft, and Anthropic plan to adopt a new shared policy token standard allowing publishers to manage AI training preferences collectively.
