Microsoft and Health-ISAC have seized and redirected domains supporting YAM Store, CoGUI and Iron Man, three parts of a Chinese-language cybercrime ecosystem used to distribute phishing campaigns worldwide.
The action was authorized by the U.S. District Court for the Southern District of Florida, according to SecurityWeek’s report on Microsoft’s announcement. Health-ISAC joined the civil lawsuit because the same infrastructure had been used to target hospitals and other healthcare organizations.
The disruption was reported on 14 October 2026. Microsoft attributed more than one billion malicious messages to the three services since January 2026, including more than 750 million directed at Microsoft customers. Those totals describe messages, not unique recipients, compromised accounts or confirmed victims.
Domains redirected and more than 20,000 accounts disabled
The operation targeted infrastructure supporting two connected layers of the phishing business.
YAM Store, which Microsoft tracks as Storm-3119, acted as an access and infrastructure broker. CoGUI and Iron Man belong to a group of phishing kits tracked as Storm-2990, alongside Haozi.
As part of the disruption:
- Domains supporting YAM Store, CoGUI and Iron Man were seized and redirected.
- More than 20,000 accounts associated with YAM Store were disabled.
- More than 100,000 domains used for impersonation and fraud are being blocked.
- Additional infrastructure is being removed based on findings from the investigation, according to the 14 October report from BleepingComputer.
Microsoft said the services targeted consumers and more than 75,000 organizations across more than 150 countries. It also estimated that their operators generated tens of millions of dollars. These figures are Microsoft’s assessment of the operation’s scale and revenue.
Japan’s National Police Agency alerted Microsoft in late 2025 after detecting malicious messaging campaigns aimed at people in Japan. Other participants named in reports include Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, and U.S. and international law-enforcement bodies.
YAM Store supplied cloud accounts and hosting to phishing operators
YAM Store’s role went beyond selling domains. Microsoft said the service hijacked Microsoft 365 and Azure for Education tenants, then resold accounts, licenses and storage to downstream operators, including users of the Storm-2990 phishing kits.
The marketplace also offered infrastructure created from compromised or fraudulently obtained Microsoft and Google environments. Customers could reportedly select accounts based on characteristics such as subscription type, account age, and whether the environment belonged to an education or nonprofit organization.
Operators acquired expired domains previously used by legitimate organizations and reconstructed websites to make those entities appear active. Those identities were then used to seek cloud accounts. Microsoft also reported that AI tools helped generate fictional organizations, including supporting content and documents.
Inside compromised Microsoft environments, the operators allegedly used stolen application credentials to administer accounts and licenses. SharePoint and OneDrive storage provided hosting for parts of the operation.
Interactive phishing kits captured credentials, codes and payment data
CoGUI and Iron Man functioned as live credential-harvesting platforms rather than static copies of login pages. Operators could watch a target’s interaction and request one-time verification codes in real time.
The kits included geofencing, IP filtering and fake CAPTCHA pages designed to restrict access and hinder security analysis. Campaign themes included unpaid tolls, traffic fines, delivery problems and account-verification requests. Microsoft also said many campaigns used device-code phishing to obtain authentication tokens.
CoGUI was used extensively against targets in Japan and the United States. Proofpoint had identified CoGUI email campaigns consistently targeting Japan in late 2024, with messages impersonating prominent Japanese businesses and international organizations to steal credentials and payment information.
By mid-2026, Iron Man was increasingly taking CoGUI’s place. YAM Store began advertising Iron Man in June 2026.
Microsoft counted more than 2,335 Iron Man templates covering more than 139 countries, with the largest collection focused on the United States. Many U.S. templates impersonated transport agencies, parking authorities and other government-related services.
Resecurity produced a separate count of 2,360 phishing packages covering 130 countries and areas, with updates through 1 October 2026. The two figures use different descriptions and geographic groupings and should not be treated as measurements of precisely the same catalogue.
Iron Man’s licensing system created a central dependency
Resecurity purchased an Iron Man license and operated the kit in an isolated laboratory. Its analysis found that deployments had to contact the vendor’s licensing server regularly to remain functional.
The researchers assessed that disabling or sinkholing the authorization host could impair every active deployment dependent on that server, rather than only one phishing site. Reports of the disruption do not establish that this specific authorization host was among the infrastructure redirected.
Resecurity also identified a subsystem for selecting payment-card capture pages. Separately, it found a publicly exposed Git/container registry holding 911 published builds associated with eight registered accounts.
Microsoft assesses with high confidence that Chinese-speaking threat actors developed the phishing kits. Similarities in infrastructure and overlaps in activity led the company to consider shared origins, reused code or close cooperation among the developers.
What users and organizations should watch for
The domain seizures, account closures and blocking measures can interrupt hosting, sales and active phishing pages. They do not establish whether credentials, payment details or authentication tokens submitted before the disruption remain in criminal hands.
Users should avoid entering credentials, card details, one-time codes or device-authorization codes after following links in unsolicited email or SMS messages. Toll, parking, delivery and account-verification notices should be checked through the organization’s known website or application rather than through the message.
Organizations using Microsoft cloud services should investigate unexpected account, license, application-credential, SharePoint or OneDrive activity—particularly where education or nonprofit tenants are involved. Any credentials suspected of exposure should be revoked or reset, along with active sessions and tokens where applicable.
