Civil suit lets Microsoft and Health-ISAC seize domains behind more than 1 billion phishing messages
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, phishing services tied to more than 1 billion messages since January. Microsoft's Steven Masada wrote that the three are only part of a larger criminal network.
The Watch · Security desk
A bar shows that over 750 million of the more than one billion malicious messages sent with the three services since January 2026 were aimed at Microsoft customers, according to Microsoft.
- Aimed at Microsoft customers, over, claim 3 750,000,000 of 1,000,000,000 messages 75% computed
Aimed at Microsoft customers, over The whole
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| Aimed at Microsoft customers, over | 750,000,000 messages | 1,000,000,000 messages | 75% (computed) | 3 |
What happened
- The action rests on an order from the US District Court for the Southern District of Florida, and Health-ISAC joined the civil suit because hospitals were frequent targets.
- Microsoft says the messages reached consumers and more than 75,000 organizations in over 150 countries, and more than 750 million were aimed at Microsoft customers.
- Microsoft tracks YAM Store as Storm-3119, an access broker that hijacks Microsoft 365 and Azure for Education tenants and resells them to downstream operations.
- CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was increasingly replaced by Iron Man, which YAM Store began advertising in June 2026.
- Microsoft has disabled more than 20,000 YAM Store accounts and is blocking more than 100,000 domains used for impersonation and fraud.
Why it matters
- constraint Reach is the limit. The order works on domains and on accounts Microsoft hosts, so each further target depends on who hosts it.
- exposure Accounts guarded only by one-time codes stay exposed to lures that ask for the code while the victim is on the page.
- precedent Health-ISAC's role shows a sector body can sit beside a platform owner as a party to a civil suit. Other sectors with a frequent-target problem have that template.
The court order works best on assets the plaintiffs host. YAM Store resold hijacked Microsoft 365 and Azure for Education tenants, Microsoft's threat intelligence team said, so Microsoft could shut those accounts from inside its own platform [13]. Buyers picked tenants by age, subscription type and environment type, such as education or nonprofit [12]. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs joined the investigation, along with US and international law enforcement [6].
Steven Masada, general manager of Microsoft's Digital Crimes Unit, set a modest goal. He wrote that disrupting the services "makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on" [7]. CyberScoop describes the effort as dismantling an ecosystem [11]. The facts in both reports fit a narrower description. Three named services lost their domains [1], and Haozi, the third kit Microsoft says YAM Store sold, is not named among them [18].
Iron Man's size is reported two ways. Microsoft counts more than 2,335 templates for over 139 countries [21]. Resecurity bought a license, ran the kit in an isolated lab and counted 2,360 templates across 130 countries and areas, the newest added October 1 [22]. Microsoft says most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees [17].
Resecurity also found that the kit needs regular contact with the vendor's licensing server. It said that "disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation" [16]. Neither report says whether the seized domains include that host, or whether anyone has been charged.
The kits are live platforms. Operators watch victims in real time and prompt them for one-time verification codes [8]. Microsoft says criminals also abused device code authentication to obtain tokens [9]. Researchers said the main use was financial fraud, with stolen payment data used to buy high-end goods, according to CyberScoop [10]. SecurityWeek reports the operators made tens of millions of dollars [4].
The sources disagree on when the work began. SecurityWeek reports it started in late 2025, when Japan's National Police Agency alerted Microsoft to messaging campaigns [19]. CyberScoop says Microsoft and Japanese authorities began investigating in early 2025 [20]. The message total Microsoft cites starts in January 2026 [3].
What to watch
- Whether the Iron Man authorization host is seized or sinkholed, which Resecurity says would degrade every active deployment.
- Whether Iron Man template counts keep rising past Resecurity's October 1 count, and whether a Haozi or successor kit fills the gap.
- Whether the Southern District of Florida case names defendants or produces charges.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+15
- Incentives45
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft and Health-ISAC seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.
- [2]
The action was based on an order from the US District Court for the Southern District of Florida, and Health-ISAC joined the civil lawsuit after threat actors frequently used the cybercrime infrastructure to target hospitals and healthcare organizations.
- [3]
According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026, targeting consumers and over 75,000 organizations in more than 150 countries; over 750 million were aimed at Microsoft customers.
- [4]
The operators made tens of millions of dollars.
- [5]
Microsoft has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
- [6]
Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort, along with US and international law enforcement.
- [7]
Steven Masada, general manager of Microsoft's Digital Crimes Unit, wrote: "YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on."
- [8]
The kits function as live, interactive platforms for credential harvesting, letting operators monitor victims in real time and prompt them for one-time verification codes.
- [9]
Microsoft said cybercriminals used the phishing kits to steal credentials and financial data and to abuse the device code authentication process to obtain authentication tokens and access compromised accounts.
- [10]
Researchers said cybercriminals primarily used the tools for financial fraud, typically using stolen payment data to make fraudulent purchases of high-end goods or transactions on legitimate financial platforms.
- [11]
CyberScoop describes the effort as Microsoft and partners acting to dismantle an expansive ecosystem of Chinese-language cybercrime tools and services.
- [12]
YAM Store sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google; buyers could choose based on age, subscription type and environment type, such as education or nonprofit.
- [13]
Microsoft tracks YAM Store as Storm-3119; its threat intelligence team described it as an access broker that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses and storage to downstream operations, including the Storm-2990 phishing kits.
- [14]
The Storm-2990 phishing kits sold on YAM Store are called CoGUI, Haozi and Iron Man.
- [15]
CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was increasingly being replaced by Iron Man, which YAM Store started advertising in June 2026.
- [16]
Resecurity found that Iron Man needs regular contact with the vendor's licensing server to function, and said that disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation.
- [17]
The US accounts for the largest number of Iron Man templates, and most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees.
- [18]
Haozi, a Storm-2990 kit sold on YAM Store, is not among the three services named in the seizure.
- [19]
The investigation began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan.
- [20]
Microsoft and Japanese authorities started investigating the interconnected network in early 2025.
- [21]
Iron Man offers more than 2,335 templates tailored to over 139 countries, according to Microsoft.
- [22]
Resecurity bought an Iron Man license and ran the kit in an isolated lab; it counted 2,360 templates covering 130 countries and areas, and the newest was added on October 1.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
3 independent publishers whose own reporting we read for this story.
- cyberscoop.comMicrosoft and partners disrupt vast Chinese-language phishing kit ecosystem
1 article · October 14, 2026
- securityweek.comMicrosoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
1 article · October 14, 2026
- therecord.mediaMicrosoft takes down 3 major phishing platforms used by Chinese cybercriminals
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Device Code PhishingFollow
- Cybercrime takedownsFollow
- Access brokersFollow
- Phishing-as-a-service kitsFollow