Microsoft, the healthcare security group Health-ISAC and Japan’s National Police Agency have disrupted a Chinese-language cybercrime ecosystem that supplied the tools behind many everyday scam messages. Under an order from the U.S. District Court for the Southern District of Florida, they seized and redirected domains supporting three services: YAM Store, an underground marketplace, and two phishing-kit services, CoGUI and Iron Man. Microsoft says the operation sent more than 750 million malicious emails and texts at its customers since January, and that the wider activity reached over 75,000 impersonated organizations in more than 150 countries.
The pieces fit together like a supply chain. YAM Store sold ready-made infrastructure: compromised or fraudulently obtained Microsoft and Google accounts, licenses and storage, plus domains that real organizations had let expire and that were rebuilt to look active again. Iron Man, which Resecurity describes as a phishing-as-a-service operation, rented out more than 2,300 lure templates impersonating postal and delivery services, traffic-fine offices, banks, tax agencies and telecoms, with features meant to block security analysis such as fake CAPTCHA gates and geofencing. CoGUI was used heavily against people in the United States and Japan before criminals shifted to Iron Man by mid-2026. Microsoft says most of these lures aim to steal credentials, personal data and card details. As part of the action it disabled more than 20,000 YAM Store-linked accounts and is blocking over 100,000 impersonation domains, with more infrastructure still being removed. Microsoft’s own security blog and Resecurity’s analysis carry the full technical detail.
The takedown does not end these scams, since the kits are sold to many customers and similar services exist, but it removes a large shared supplier. The messages themselves look the same as before: unpaid toll or traffic-fine texts, delivery problems, and “verify your account” requests.
How to check if you’re affected
There is no single list of victims, so the useful check is on your own accounts. Affected products are any Microsoft 365 or Google account you may have signed in to from a link in an unexpected toll, parcel, fine or account-verification message. If you did, change that password from the real service’s website, review the account’s recent sign-in activity and connected devices, and turn on multi-factor authentication. For card details entered on such a page, call your bank to replace the card. Going forward, reach toll, parcel and government services by typing the official address or using their app rather than tapping the link in the message.
Sources
- Microsoft Security Blog: The hidden network inside the phishing infrastructure ecosystem powering global cybercrime
- Resecurity: Iron Man and YAM Store, powering a global phishing-as-a-service ecosystem
- Proofpoint: Disruption targets major Chinese-language phishing kits with a Japanese focus
- BleepingComputer: Global takedown hits network behind 1 billion phishing messages
- The Record: Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals