MICROSOFT DISRUPTS THREE MAJOR CYBERCRIME PLATFORMS LINKED TO MORE THAN ONE BILLION PHISHING MESSAGES WORLDWIDE

REDMOND, WASHINGTON — Microsoft has announced a coordinated international operation targeting three major components of a Chinese-language cybercrime network responsible for enabling more than one billion malicious emails and text messages since January 2026. The October 14 action targeted YAM Store, CoGUI, and Iron Man, interconnected services that supplied criminals with fraudulent online accounts, phishing infrastructure, and tools designed to steal sensitive information from individuals and businesses worldwide.

The operation was led by Microsoft’s Digital Crimes Unit in cooperation with Health-ISAC, Japan’s National Police Agency, and international cybersecurity partners. Microsoft and Health-ISAC brought a federal civil action in the United States District Court for the Southern District of Florida against Yang Jian, doing business as YAM Store, Inc., and ten unidentified defendants. The court-authorized operation enabled the seizure and redirection of internet domains supporting the alleged cybercriminal infrastructure.

According to Microsoft, the three services facilitated malicious campaigns targeting more than 75,000 organizations across over 150 countries, including more than 750 million phishing messages directed toward Microsoft customers alone. The operations targeted consumers, healthcare providers, financial institutions, government-related services, and businesses, generating tens of millions of dollars for their operators.

The legal action resulted in the disabling of more than 20,000 accounts associated with YAM Store, while Microsoft continued removing malicious infrastructure from its services and blocking more than 100,000 domains connected to impersonation and fraud.

The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to extensive phishing campaigns affecting Japanese consumers and organizations. Investigators initially examined seemingly separate fraudulent messages involving delivery notices, financial services, and government impersonation before identifying shared infrastructure supporting multiple criminal operations.

Further analysis exposed a commercial network through which cybercriminals could purchase compromised accounts, fraudulent cloud environments, hosting services, and ready-made phishing websites without developing their own technical infrastructure.

At the center of the operation was YAM Store, an underground marketplace identified by Microsoft as Storm-3119. The service functioned as an initial access broker, selling access to compromised or fraudulently obtained Microsoft and Google environments.

Customers could purchase accounts and infrastructure based on characteristics including account age, subscription status, and organizational classification. Educational and nonprofit environments were among the offerings, allowing criminals to exploit the apparent legitimacy of established institutions.

Microsoft investigators discovered that YAM Store operators also exploited expired internet domains previously associated with legitimate organizations. By rebuilding websites and presenting them as active businesses or institutions, operators could obtain or abuse cloud services and resell the resulting access to other criminals.

The marketplace supported activities extending beyond credential theft. Microsoft’s technical investigation identified unauthorized control of Microsoft 365 environments, abuse of privileged application credentials, and exploitation of cloud storage services.

In some compromised environments, operators obtained administrative access that allowed them to modify accounts, allocate licenses, and use SharePoint or OneDrive storage to support additional criminal operations.

Such access can be particularly serious because privileged cloud credentials may permit an attacker to control resources beyond a single employee account. Organizations can face unauthorized account creation, data exposure, and continued misuse of their cloud infrastructure until the compromised access is identified and revoked.

YAM Store also supplied infrastructure to phishing operations that impersonated legitimate companies and government agencies. Two prominent services were CoGUI and Iron Man System, which provided preconfigured phishing websites and message templates to paying customers.

Microsoft identified a wider collection of related phishing tools that included Haozi, also known as Phoenix. The company tracks the associated phishing-kit development cluster as Storm-2990, distinguishing those tools from YAM Store’s marketplace operations.

CoGUI, also identified by the names NX and FA, was extensively used in campaigns targeting Japan and the United States. Its customers could deploy fraudulent websites imitating banks, retailers, government agencies, and other trusted organizations to collect passwords, payment card information, and personal data.

During 2026, investigators observed a shift toward Iron Man, a newer subscription-based phishing platform offering a much larger selection of ready-made fraudulent websites.

Microsoft’s examination of Iron Man uncovered more than 2,300 phishing templates, including designs impersonating transportation authorities, healthcare services, police departments, financial institutions, retailers, telecommunications companies, and parcel delivery organizations.

The templates were adapted for different languages, countries, and industries, allowing criminals to create convincing fraudulent messages for specific populations. Common examples included unpaid toll notifications, traffic violations, package delivery problems, overdue taxes, and urgent banking alerts.

These messages relied on social engineering to pressure recipients into visiting fraudulent websites and surrendering information. Once victims entered account credentials or payment card details, criminals could use the information for unauthorized access, financial transactions, or further fraud.

Microsoft’s technical investigation also identified sophisticated evasion capabilities in some phishing kits. These included geographic restrictions that limited access to selected countries, fake CAPTCHA screens, IP address filtering, and configuration options intended to interfere with automated security analysis.

Certain versions supported real-time monitoring through Telegram notifications. This allowed operators to receive updates when victims entered credentials, submitted payment information, or provided verification codes.

The ability to monitor victims during an active phishing attempt can make the operation more dangerous. Criminals may respond immediately to submitted information, attempt additional account access, or direct victims through further fraudulent verification steps.

Microsoft also documented activity involving device-code phishing, where attackers manipulate legitimate authentication procedures to obtain access tokens. This technique can result in unauthorized account access without requiring an attacker to use a stolen password directly.

The investigation revealed that the phishing services shared technical similarities despite being marketed under separate names. Microsoft assessed with high confidence that the kits were developed by Chinese-speaking threat actors, with overlapping infrastructure suggesting shared development, code reuse, or cooperation among their operators.

That assessment identifies a Chinese-language criminal ecosystem and does not, by itself, establish that the operation was directed by the Chinese government.

The services also accepted cryptocurrency payments, including USDT and Ethereum, while YAM Store offered additional payment arrangements through digital financial services. Subscription models and automated storefronts made the tools accessible to criminals possessing limited technical expertise.

Steven Masada, Associate General Counsel and General Manager of Microsoft’s Digital Crimes Unit, explained that the investigation shifted from identifying individual phishing campaigns to exposing the businesses supplying the underlying criminal infrastructure.

The operation involved intelligence and technical assistance from the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, and Health-ISAC. Microsoft also shared intelligence with the United States Secret Service and international law enforcement partners.

The collaboration helped connect activity that initially appeared unrelated, including fraudulent cloud accounts, impersonation websites, phishing templates, and infrastructure supporting large-scale criminal messaging.

Healthcare organizations were among the targeted sectors, adding concerns over unauthorized access to sensitive records, financial systems, and operational accounts. Financial institutions and technology companies also faced credential theft attempts and fraudulent communications designed to exploit established customer relationships.

The court-authorized disruption was intended to interfere with the criminal supply chain rather than address individual phishing websites one at a time. By targeting the marketplace and associated service infrastructure, Microsoft sought to limit the ability of multiple criminal groups to purchase the resources required for future campaigns.

The company emphasized that the appearance of a legitimate organization’s name or branding in a phishing template does not establish that the organization itself was compromised. Criminals frequently reproduce trusted logos, websites, and official notices without gaining access to the systems of the organizations being impersonated.

The October action follows other major Microsoft investigations targeting commercial cybercrime services, including the September 2026 disruption of EvilTokens, an AI-enabled platform used to support account compromise and financial fraud, and earlier actions involving Tycoon 2FA, RaccoonO365, and RedVDS.

These operations reflect a shift in cybercrime enforcement toward the commercial services that supply fraudulent accounts, phishing websites, and supporting infrastructure to numerous independent threat actors.

Despite the disruption, Microsoft has not claimed that every participant in the network has been identified or that all associated phishing activity has permanently stopped. Criminal groups may attempt to replace seized infrastructure or migrate to competing services.

Microsoft recommends that organizations strengthen identity security through phishing-resistant multifactor authentication, passkeys, conditional access policies, and restricted administrative privileges. Companies should also monitor unusual sign-in activity, unauthorized applications, suspicious email messages, and unexplained changes to cloud resources.

Individuals are encouraged to verify unexpected payment demands, delivery notices, and account security warnings directly through the legitimate organization rather than using links contained in unsolicited messages.

Microsoft’s October 14 operation disrupted a major international cybercrime supply chain responsible for facilitating more than one billion phishing messages across over 150 countries. The seizure and redirection of malicious domains, disabling of fraudulent accounts, and continued removal of criminal infrastructure represent a coordinated effort to reduce the availability of tools used for large-scale identity theft, account compromise, and financial fraud.

---

---

Microsoft Corporation and Health-ISAC, Inc. — Complaint, U.S. District Court for the Southern District of Florida, Case No. 1:26-cv-26998-JEM, October 6, 2026. (Free Download)

---

---

---

Microsoft Corporation and Health-ISAC, Inc. — Civil Cover Sheet (JS 44), U.S. District Court for the Southern District of Florida, Case No. 1:26-cv-26998-JEM, October 6, 2026. (Free Download)

---

---

---

U.S. District Court for the Southern District of Florida — Issued Summonses: Yang Jian d/b/a YAM Store, Inc., and Does 1–10, Case No. 1:26-cv-26998-JEM, Document 23, October 7, 2026. (Free Download)

---

---

---

Microsoft Corporation and Health-ISAC, Inc. — Plaintiffs’ Notice of Pending Refiled, Related or Similar Actions, U.S. District Court for the Southern District of Florida, Case No. 1:26-cv-26998-JEM, October 6, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---