From The Next Web · Ana Maria Constantin · · 1m 10s
Microsoft shuts down three phishing kit operations
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, which sent over one billion malicious messages since January 2026.
In brief
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, which sent over one billion malicious messages since January 2026. Microsoft and Health-ISAC disrupted three Chinese-language phishing services that sent over one billion scam messages to seventy-five thousand organisations worldwide since…
Three phishing services shut down
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man on Wednesday. Since January 2026, these Chinese-language services sent over one billion malicious messages to more than seventy-five thousand organisations worldwide.
Scale of the operation
More than seven hundred fifty million messages targeted Microsoft customers. The services reached consumers, healthcare groups, banks and businesses in more than one hundred fifty countries, generating tens of millions of dollars for operators.
“What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.”
How the phishing kits worked
YAM Store operated like an online shop selling fraudulent Microsoft and Google accounts and ready-made scam tools.CoGUI supplied ready-made websites impersonating trusted organisations.
Microsoft's enforcement action
Acting under a US District Court order for the Southern District of Florida, Microsoft disabled more than twenty thousand accounts connected to YAM Store and is blocking more than one hundred thousand domains used for…
“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.”
The bottom line
Microsoft and Health-ISAC disrupted three Chinese-language phishing services that sent over one billion scam messages to seventy-five thousand organisations worldwide since January 2026.
