Civil suit lets Microsoft and Health-ISAC seize domains behind more than 1 billion phishing messages

According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026, targeting consumers and over 75,000 organizations in more than 150 countries; over 750 million were aimed at Microsoft customers.

Microsoft and Health-ISAC seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.

The action was based on an order from the US District Court for the Southern District of Florida, and Health-ISAC joined the civil lawsuit after threat actors frequently used the cybercrime infrastructure to target hospitals and healthcare organizations.

The kits function as live, interactive platforms for credential harvesting, letting operators monitor victims in real time and prompt them for one-time verification codes.

Microsoft said cybercriminals used the phishing kits to steal credentials and financial data and to abuse the device code authentication process to obtain authentication tokens and access compromised accounts.

Microsoft has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.

Researchers said cybercriminals primarily used the tools for financial fraud, typically using stolen payment data to make fraudulent purchases of high-end goods or transactions on legitimate financial platforms.

Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort, along with US and international law enforcement.

Steven Masada, general manager of Microsoft's Digital Crimes Unit, wrote: "YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on."

YAM Store sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google; buyers could choose based on age, subscription type and environment type, such as education or nonprofit.

Microsoft tracks YAM Store as Storm-3119; its threat intelligence team described it as an access broker that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses and storage to downstream operations, including the Storm-2990 phishing kits.

The Storm-2990 phishing kits sold on YAM Store are called CoGUI, Haozi and Iron Man.

The investigation began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan.

Microsoft and Japanese authorities started investigating the interconnected network in early 2025.

Iron Man offers more than 2,335 templates tailored to over 139 countries, according to Microsoft.

Resecurity bought an Iron Man license and ran the kit in an isolated lab; it counted 2,360 templates covering 130 countries and areas, and the newest was added on October 1.

The US accounts for the largest number of Iron Man templates, and most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees.

Haozi, a Storm-2990 kit sold on YAM Store, is not among the three services named in the seizure.

The operators made tens of millions of dollars.