YAM Store, CoGUI, Iron Man: Microsoft’s Billion-Message Phishing Bust

WarBrief Live | October 16, 2026 | Cybersecurity

Microsoft’s published case figures for YAM Store, CoGUI and Iron Man, January to October 2026.

On October 14, 2026, Microsoft and the nonprofit Health-ISAC announced they had seized the domain names behind YAM Store, CoGUI and Iron Man — three Chinese-language services that together powered more than one billion malicious messages this year. Backed by a US federal court order, the action is one of the largest phishing-infrastructure disruptions ever disclosed. Here is what investigators confirmed, what remains unverified, and what it means for you.

What happened in the YAM Store takedown?

On October 14, 2026, Microsoft’s Digital Crimes Unit and Health-ISAC — a global nonprofit that helps health-sector organizations share cyber-threat information — announced a coordinated legal and technical action against three components of a Chinese-language cybercrime marketplace. The services, known as YAM Store, CoGUI and Iron Man, supplied criminals with fraudulent accounts, ready-made phishing websites and impersonation templates.

A week earlier, on October 7, a federal judge in the US District Court for the Southern District of Florida had granted Microsoft and Health-ISAC’s request to take control of the services’ domain names, effectively severing the marketplaces from their infrastructure. Microsoft now controls and redirects those domains. Alongside the seizure, the company disabled more than 20,000 accounts tied to YAM Store and began blocking more than 100,000 domains used for impersonation and fraud, according to SecurityWeek’s reporting on Microsoft’s case materials.

Health-ISAC joined the civil lawsuit after threat actors repeatedly used the infrastructure to target hospitals and healthcare organizations — a detail that explains why a health-sector body co-led an action against a general phishing marketplace.

What is CoGUI?

CoGUI was one of three linked services, each covering a different part of the scam supply chain. YAM Store sold accounts and infrastructure: fraudulent Microsoft and Google accounts, identity-theft tools and hosting built on expired domains and hijacked cloud tenants. CoGUI sold the phishing kits themselves — ready-made fake websites and messages that impersonated governments, banks and technology companies. Iron Man, which investigators say gained traction from mid-2026, offered more than 2,300 impersonation templates covering healthcare firms, retailers and even police departments, according to Microsoft’s technical reporting cited by Cybersecurity Dive.

The kits were built for scale and evasion. Common lures included unpaid tolls, delivery problems and account-verification warnings — the same smishing texts millions of people receive. The kits supported geofencing, fake CAPTCHA gates and IP filtering so that only intended victims saw the fake pages, while security researchers were shown harmless content. Many campaigns also used device-code phishing to steal authentication tokens, and Iron Man added Telegram alerts and a live channel that let operators watch victims fill in credentials in real time.

Microsoft tracks the marketplace as Storm-3119 and assesses that Chinese-speaking actors tracked as Storm-2990 developed the kits — attributions reported by Microsoft’s own threat researchers and relayed by specialist outlets, not independently verified by law enforcement.

How did the takedown work?

The operation ran on two tracks: legal and technical. Legally, Microsoft and Health-ISAC filed a civil action and won a temporary restraining order from the Southern District of Florida, which authorized the domain seizures. The order is an interim measure — it does not amount to a criminal conviction or a final judgment, and Microsoft says it is seeking a permanent injunction and damages.

Technically, the seizure cut the marketplaces off from the domains their customers used to reach them, while the account disables and domain blocks degraded the infrastructure the kits relied on. Microsoft says removal of additional infrastructure hosted on its own platforms is ongoing.

The partnership behind the case was unusually broad. The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. The probe then drew in the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs — whose blockchain intelligence helped locate and freeze assets tied to the group, according to TRM Labs. Microsoft also worked with the US Secret Service and international law enforcement.

As Steven Masada, general manager of Microsoft’s Digital Crimes Unit, put it in the announcement:

“The scam message is often the only part victims see. The businesses behind it are what make it possible.”

The five-stage pipeline: how YAM Store operated

Microsoft’s technical writeup describes YAM Store as a five-stage pipeline designed to mass-produce trusted-looking scam infrastructure. First, automated reconnaissance — run through the Tor network — found and profiled organizations with cloud tenants. Second, the operators took over those tenants through actor-controlled admin panels that used stolen application credentials to silently reset passwords and assign education licenses. Third, compromised Global Administrator accounts were abused to grant broad permissions and bulk-host phishing pages on SharePoint and OneDrive. Fourth, a custom DNS platform managed the phishing domains, certificates and routing. Fifth, an automated storefront — with a sub-reseller tier — sold it all, accepting cryptocurrency as well as Alipay and WeChat Pay.

The operators also fabricated legitimacy: Microsoft found a fake nonprofit built on a recently registered .org domain, and buyers could purchase expired domains once tied to real organizations, which made the resulting phishing sites look trustworthy to victims and email filters alike. For context on how investigators map this kind of hidden infrastructure, see our guide to tracking adversary infrastructure with internet intelligence.

Read next: Operation KillSwitch — how investigators dismantled the KillSec ransomware crew.

By the numbers: the scale of the scam economy

Metric	Figure	Source
Malicious messages enabled (Jan–Oct 2026)	1,000,000,000+ (CONFIRMED)	Microsoft / Health-ISAC
Organizations targeted	75,000+ (CONFIRMED)	Microsoft / Health-ISAC
Countries affected	150+ (CONFIRMED)	Microsoft / Health-ISAC
Messages aimed at Microsoft customers	750,000,000+ (CONFIRMED)	Microsoft / Health-ISAC
YAM Store-linked accounts disabled	20,000+ (CONFIRMED)	Microsoft
Fraud domains blocked	100,000+ (CONFIRMED)	Microsoft
Iron Man impersonation templates	2,300+ (CONFIRMED)	Microsoft
Revenue earned by the operators	Tens of millions of dollars (REPORTED)	Microsoft-attributed, single-source reporting

Caveat: figures marked CONFIRMED come from Microsoft’s published case materials and appear across multiple outlets; the revenue figure is Microsoft-attributed reporting from a single source and should be treated as provisional.

What the YAM Store takedown means for US/UK/EU readers

The kits may have been sold in Chinese, but their output was multilingual — including English-language smishing impersonating parcel carriers, toll authorities, banks and government agencies in the US, UK and EU. If your scam-text volume drops in the coming weeks, this takedown is one reason why. Do not, however, assume the threat is gone: investigators explicitly describe this as a disruption, not an eradication.

Practical steps that actually help: never tap links in unexpected delivery, toll or banking texts — open the carrier’s or bank’s official app yourself instead. Treat any message urging immediate action (“your account will be locked today”) as hostile. Be especially wary of sign-in prompts that ask you to enter a code shown on another device — that is the device-code phishing technique these kits industrialized. And if a caller claims to be your bank or health provider, hang up and call back on the number printed on your card or the organization’s official site.

For organizations, the case is a reminder that defense contractors already face strict, audited cyber requirements — while many healthcare providers, retailers and small firms targeted by these kits still do not.

Why this bust matters beyond the headlines

The YAM Store case is part of a wider shift in how authorities fight cybercrime: instead of chasing individual scammers, they are dismantling the service economy that makes scamming cheap and scalable. Microsoft’s framing is deliberate — the scam message is the visible tip; the marketplace selling accounts, kits and infrastructure is the factory.

The same logic drove Operation KillSwitch, which dismantled the KillSec ransomware crew earlier this month: target the business model, not just the foot soldiers. Phishing kits like CoGUI and Iron Man are to fraud what ransomware-as-a-service was to extortion — a franchise model that lets low-skill criminals run high-volume campaigns. Cutting off the franchise supplier raises the cost of every downstream scam.

Browse more takedowns and cyber operations in our intelligence hub.

Different perspectives

Microsoft and the Digital Crimes Unit present the action as proof that the private sector can disrupt transnational cybercrime at scale when it combines legal tools with technical ones — the unit has used similar civil-seizure playbooks against botnets for years.

Health-ISAC and the healthcare sector see it as sector self-defense: hospitals were being impersonated and targeted, and the nonprofit’s participation signals that critical sectors are willing to co-litigate rather than wait for law enforcement alone.

Independent researchers are more cautious. Takedowns of marketplaces historically produce displacement, not extinction — operators rebrand, infrastructure migrates, and demand for phishing kits persists. Microsoft’s own statement concedes the three services were “only part of that larger criminal network.” Until operators are identified and arrested, the honest assessment is disruption, not defeat.

What to watch next in the YAM Store case

• October–November 2026: whether Microsoft secures the permanent injunction and damages it is seeking in the Florida civil case.
• Rebranding: watch for successor marketplaces — reporting already links the same actor cluster to additional kits such as Haozi, and Iron Man itself only emerged around June 2026.
• Law-enforcement follow-up: whether the US Secret Service or international partners move from the civil disruption to criminal charges against identified operators.
• The Japan angle: what the late-2025 NPA tip reveals about how scam campaigns in one country expose global infrastructure — a model other national police forces may copy.

Frequently asked questions

What is the CoGUI phishing kit?
CoGUI was a Chinese-language phishing kit sold through the YAM Store marketplace. It gave criminals ready-made fake websites and scam messages that impersonated governments, banks and technology companies, with built-in evasion features such as geofencing, fake CAPTCHA gates and IP filtering. Microsoft and Health-ISAC seized its domains under a US court order in October 2026.

What happened to YAM Store in October 2026?
On October 7, 2026, a US federal court in the Southern District of Florida granted Microsoft and Health-ISAC control of the domains behind YAM Store, CoGUI and Iron Man. The action was announced on October 14. Microsoft also disabled more than 20,000 linked accounts and is blocking over 100,000 fraud domains. It is a civil disruption, not a criminal conviction.

How did investigators find the phishing marketplace?
The probe began in late 2025, when Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan. Tracing those campaigns led investigators to the wider marketplace. The Japan Cybercrime Control Center, plus companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, helped map the infrastructure.

Will the takedown stop the scam messages I receive?
Probably not entirely — and investigators do not claim it will. The action disrupts the supply of phishing kits and infrastructure, which should reduce volume and raise scammers’ costs, but operators can rebuild under new names. Microsoft describes the three services as only part of a larger criminal network.

How can I protect myself from phishing-kit scams?
Do not click links in unexpected texts or emails about deliveries, tolls or bank accounts — open the official app instead. Never enter a sign-in code displayed on one device into another (device-code phishing). Verify urgent callers by hanging up and calling back on a published number, and keep multi-factor authentication enabled on every important account.

Sources

• Health-ISAC: Disrupting the service economy behind transnational cybercrime operations (official joint statement)
• SecurityWeek: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
• Cybersecurity Dive: Microsoft, Health-ISAC and partners take down popular phishing kit services
• TRM Labs: Supporting Microsoft’s disruption of YAM Store, CoGUI and Iron Man
• Help Net Security: Microsoft disrupting phishing kits marketplace YAM Store