Microsoft, in collaboration with Health-ISAC, has successfully disrupted a Chinese-language phishing market responsible for the distribution of over one billion malicious messages globally. The operation targeted three primary components of the cybercrime network: YAM Store, CoGUI, and Iron Man, which were involved in providing cybercriminals with essential tools and infrastructure.
Legal Action and Global Impact
The intervention was carried out following an order from the US District Court for the Southern District of Florida. Health-ISAC became involved in the legal proceedings due to the frequent attacks on healthcare facilities. These cybercrime services were responsible for sending detrimental messages to consumers and over 75,000 organizations in more than 150 countries, with 750 million messages targeting Microsoft users. The perpetrators reaped tens of millions of dollars from these illicit activities.
Microsoft’s efforts led to the disabling of over 20,000 accounts linked to YAM Store, and more than 100,000 fraudulent domains have been blocked. This significant action is part of a larger investigation that began in late 2025 when Japan’s National Police Agency alerted Microsoft to suspicious messaging campaigns. This initiative has seen collaboration from notable companies and international law enforcement agencies.
The Network’s Structure and Operations
YAM Store, identified by Microsoft as Storm-3119, operated by selling access to compromised or fraudulently obtained environments from major providers like Microsoft and Google. The marketplace allowed buyers to select based on factors such as age and subscription type. YAM Store served as an intermediary, hijacking Microsoft 365 and Azure for Education tenants to resell them.
The phishing kits, known as Storm-2990, were distributed through YAM Store and included CoGUI, Haozi, and Iron Man. Microsoft’s threat intelligence suggests that these kits were developed by Chinese-speaking threat actors, with similarities in their infrastructure indicating possible shared origins or collaboration among developers.
Evolution and Capabilities of Phishing Kits
Initially, the CoGUI kit was predominantly used against targets in Japan and the US. However, by mid-2026, Iron Man, which began being promoted in June 2026, started to replace CoGUI. Iron Man boasts over 2,335 templates catering to more than 139 countries, with the US having the highest number of templates that often mimic government entities.
These phishing kits operate as dynamic platforms for credential harvesting, enabling real-time victim monitoring and prompting for one-time codes. An investigation by Resecurity, which acquired an Iron Man license, identified 2,360 templates across 130 regions, reinforcing the kit’s dependency on regular contact with the vendor’s server to function.
The shutdown of these services marks a significant blow to cybercriminals, complicating their ability to access the tools and infrastructure integral to their operations. Microsoft’s continued efforts in cybersecurity ensure a safer digital environment for users worldwide.
