Microsoft disrupts phishing network targeting 75,000 organizations

Microsoft and the Health-ISAC cybersecurity group obtained a U.S. court order to seize and redirect domains used by YAM Store, CoGUI and Iron Man. The three services sold compromised accounts, cloud resources, hosting, phishing pages and scam messages to criminal customers.

The services supported campaigns against businesses and consumers worldwide since January, generating tens of millions of dollars for their operators. The investigation began after Japan’s National Police Agency alerted Microsoft to scams targeting consumers and businesses in late 2025. Investigators traced the campaigns to a Chinese-language criminal marketplace.

YAM Store supplied stolen Microsoft and Google accounts, cloud resources and hosting. Some operators revived expired domains previously used by nonprofit and educational organizations, then used those sites to obtain Microsoft 365 accounts for resale. YAM Store also operated a reseller network that distributed accounts and infrastructure.

CoGUI and Iron Man provided phishing pages and messages that imitated banks, retailers, transport authorities and government agencies. Microsoft and cybersecurity firm Resecurity identified more than 2,300 Iron Man templates that customers could adapt for scams targeting specific brands and countries.

The services accepted cryptocurrency payments, including Tether’s USDT and Ethereum. YAM Store accepted USDT on the Tron network, as well as Alipay and WeChat Pay. Cloudflare reported that buyers could use USDC for some marketplace services.

Blockchain analytics firm TRM Labs helped investigators locate assets linked to the group and freeze them. The value of the frozen funds was not disclosed.

The operation disrupted infrastructure used after customers bought the phishing products. Cloudflare suspended accounts, disabled Workers projects hosting phishing pages and banned hundreds of related domains and projects. Where domains could not be seized, it placed warning pages before malicious links.

Microsoft also identified a licensing server controlled by a vendor that Iron Man customers needed to use some phishing software. Disabling the server could prevent access to purchased phishing kits even if copies of the software remained available.

Microsoft disabled more than 20,000 accounts linked to YAM Store and continued blocking more than 100,000 impersonation and fraud domains. The enforcement effort involved Japan’s police and Cybercrime Control Center, Oracle, Proofpoint, Resecurity and U.S. law-enforcement partners.

Microsoft described the three suppliers as part of a broader criminal network, with related infrastructure still being removed. Cloudflare reported that some registrars operate in jurisdictions where legal domain seizures are difficult, allowing replacement domains to remain online while access to them is blocked.