Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, phishing services tied to more than 1 billion messages since January. Microsoft's Steven Masada wrote that the three are only part of a larger criminal network.
Perspective Coverage
14 publishers
- Builder
- Builder 11%
- Operator
- Operator 68%
- Investor
- Investor 21%
Reality
- Evidence70
- Adoption70
- Hype gap+15
- Incentives55
- Confidence74
Microsoft seeks control of Yam Store domains in a suit it brought with Health-ISAC
Microsoft and Health-ISAC have sued Yang Jian, doing business as Yam Store, and Does 1-10 in case 1:26-cv-26998. A court has authorized service by electronic means, and Microsoft alleges the defendants hosted a cybercriminal operation through Internet domains.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives60
- Confidence55
Microsoft and international partners dismantled the Yam Store phishing marketplace, whose kits enabled more than 1 billion malicious messages. Microsoft says buyers could deploy the pre-made kits very quickly, so a polished lure says little about the sender's skill.
Perspective Coverage
4 publishers
- Builder
- Builder 16%
- Operator
- Operator 56%
- Investor
- Investor 28%
Reality
- Evidence55
- Adoption70
- Hype gap+15
- Incentives60
- Confidence65
buildOne report1 publisher ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns
Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.
Perspective Coverage
9 publishers
- Builder
- Builder 17%
- Operator
- Operator 66%
- Investor
- Investor 17%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+40
- Incentives70
- Confidence55
Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.
Perspective Coverage
8 publishers
- Builder
- Builder 25%
- Operator
- Operator 60%
- Investor
- Investor 15%
Reality
- Evidence66
- Adoption58
- Hype gap+18
- Incentives62
- Confidence64