Key points
- Microsoft and Health-ISAC seized domains supporting YAM Store, CoGUI and Iron Man following a US court order.
- More than 20,000 accounts connected to the YAM Store marketplace have been disabled by Microsoft.
- The infrastructure enabled over 750 million malicious messages targeting Microsoft customers since January 2026.
Microsoft and Health-ISAC have dismantled key components of a cybercrime ecosystem, seizing domains for YAM Store, CoGUI and Iron Man. These services facilitated phishing campaigns targeting healthcare providers and critical infrastructure across more than 150 countries.
What happened
Microsoft reported that the dismantled infrastructure enabled more than one billion malicious messages since January 2026. These campaigns targeted over 75,000 organisations worldwide, including financial institutions and government agencies. The operation generated tens of millions of dollars for the operators.
The investigation involved Japan’s National Police Agency and the Japan Cybercrime Control Center. Partners included Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. They traced the scams to a Chinese-language marketplace supplying fraudulent accounts and impersonation tools.
With a US District Court order, Microsoft and Health-ISAC seized and redirected the supporting domains. Microsoft stated it has disabled more than 20,000 accounts connected to YAM Store. The company continues to remove hosted infrastructure and block over 100,000 domains used for fraud.
Why it matters
Steven Masada of Microsoft’s Digital Crimes Unit noted the difficulty of penetrating the Chinese-language ecosystem. CoGUI provided criminals with ready-made websites and messages impersonating trusted entities. This allowed attackers to deploy credential-stealing pages without building them from scratch.
Investigators identified more than 2,300 Iron Man templates impersonating organisations globally. These templates targeted banks, healthcare providers, telecommunications companies and retailers. The sheer volume of impersonation tools suggests a highly industrialised approach to fraud.
The seizure disrupts the underlying infrastructure powering these three services. By redirecting domains, authorities aim to stop the flow of stolen credentials and payment data. This action impacts the operational capacity of the cybercrime marketplace significantly.
What happens next
- Monitor for new domains or templates associated with YAM Store or Iron Man.
- Review logs for login attempts from accounts linked to the disabled infrastructure.
- Validate the authenticity of any unexpected communications claiming to be from targeted sectors.
- Coordinate with industry ISACs for updates on emerging impersonation tactics.
Patch priority
Security teams should prioritise systems exposed to external email and web traffic. Verify that authentication mechanisms are robust and monitor for anomalous login patterns. Conduct regular audits of active accounts to identify any compromised credentials. Ensure that web proxies and firewalls are configured to block known malicious domains. Test incident response procedures for phishing alerts to ensure rapid containment. Back up critical configuration data before making any changes to network security settings.
What to do and how to stay safe: Microsoft
- Review email gateways for messages originating from newly seized or redirected domains.
- Enforce multi-factor authentication for all user accounts to mitigate credential theft risks.
- Monitor network logs for connections to infrastructure associated with YAM Store.
- Educate staff on identifying impersonation attempts from banks and healthcare providers.
Step-by-step guide: Seven Social Engineering Mistakes That Leave Your Defences Open
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific services were dismantled in this operation?
Microsoft and Health-ISAC dismantled YAM Store, CoGUI and Iron Man, which provided phishing tools and infrastructure.
How many accounts were disabled by Microsoft?
Microsoft has disabled more than 20,000 accounts connected to the YAM Store marketplace.
What was the scale of the phishing campaigns?
The campaigns sent more than one billion malicious messages targeting over 75,000 organisations since January 2026.
