Microsoft said on 14th October, 2026 that it seized domains behind YAM Store, CoGUI and Iron Man, three Chinese-language phishing services, under a U.S. court order. The wider ecosystem has pushed more than 1 billion phishing emails and texts since January.
The Brief
- Microsoft disabled more than 20,000 accounts tied to YAM Store, a market selling compromised or fraudulently obtained Microsoft and Google cloud accounts.
- Japanese police flagged scam texts aimed at people in Japan in early 2025, which started the investigation.
- Resecurity found 2,360 lure templates on Iron Man, copying banks, police and government agencies in 130 countries.
- Microsoft is still blocking more than 100,000 domains used to impersonate trusted brands and agencies.
Microsoft tracks the cluster behind the kits as Storm-2990. Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, set out the case in a company blog post. More than 750 million of the messages targeted Microsoft customers, across more than 150 countries.
The campaigns generated tens of millions of dollars for their operators, Microsoft said. Most aimed to steal logins, personal details and banking data, the usual haul in phishing email campaigns. Targets included healthcare, financial services, logistics and IT, predominantly in the U.S. and Japan. Japan’s National Police Agency and Health-ISAC, the healthcare sector’s threat-sharing group, helped Microsoft secure the court order.
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. https://t.co/YLYwaAcqF2
— Microsoft Threat Intelligence (@MsftSecIntel) October 14, 2026
YAM Store rented scammers a trusted identity
YAM Store worked as an initial access broker. Microsoft researchers said it “sells infrastructure using compromised or fraudulently obtained environments in providers like Microsoft and Google.” Buyers could filter by account age, subscription type and environment, including .edu and .org tenants, then pick the cheapest.
That filter list is the tell. An aged university or nonprofit tenant likely carries more sender trust than a fresh throwaway account. That may explain why age was a listed filter.
Operators also bought domains that real companies had let lapse. They rebuilt those sites as convincing fakes, harvested Microsoft 365 credentials and resold the stolen logins on YAM Store. The loop fed itself.
The three services split the work:
- YAM Store sold the accounts and domains that carried the campaigns.
- CoGUI supplied ready-made sites and messages copying brands, agencies and banks, and was used heavily against people in Japan.
- Iron Man sold phishing-kit subscriptions with country-specific lure packs for Australia, Japan, India and dozens more.
Criminals began moving from CoGUI to Iron Man by mid-2026. Investigators also found the kits abusing the device code sign-in process to obtain authentication tokens and enter compromised accounts. Shared infrastructure across all three pointed to common development origins or close collaboration among their builders.
The strike hits suppliers and leaves gaps
The case extends a run of court-backed actions by the Digital Crimes Unit. Last month, Microsoft took the AI-powered EvilTokens platform offline and worked with U.K. police to arrest its alleged operators. In June, it dismantled hundreds of servers and domains tied to SocGholish, Amadey and StealC, after earlier cases against RaccoonO365 and RedVDS.
The common thread is supply. Each case goes after the shops that rent accounts, kits and servers, so one seizure can starve many downstream crews at once. Cloudflare, Oracle, Proofpoint and TRM Labs supported the research, while Resecurity infiltrated the sites.
Masada framed the win narrowly. He wrote that the three services are only part of a larger criminal network. “The scam message is often the only part victims see,” he added.
What’s Next?
The disclosures leave gaps. They do not name the court or say whether any YAM Store operator has been identified or charged. Nor do they explain what Google did about environments sold from its platform, or how many victims lost money.
For readers, the practical step is simple. Anyone who entered a code on a Microsoft sign-in page after an unsolicited message should sign out all sessions and reset the password. Treating surprise toll, parcel and tax scam texts as suspect helps reduce risk.
Microsoft said it is still pulling YAM Store infrastructure off its own services and adding to the domain blocklist. For the operators, the next test is how fast they can rebuild on clean accounts.
