Key points
- Microsoft and Health-ISAC seized domains for YAM Store, CoGUI, and Iron Man under a US court order.
- The services enabled more than 1 billion malicious messages targeting over 75,000 organizations globally.
- More than 750 million of those messages targeted Microsoft customers across 150 countries.
Microsoft and Health-ISAC have seized and redirected the domains behind three Chinese-language cybercrime services that facilitated more than 1 billion scam messages. This action disrupts the operations of YAM Store, CoGUI, and Iron Man, which targeted organizations worldwide. The intervention prevents further distribution of malicious content from these specific infrastructure points.
How it unfolded
- Late 2025: Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan, initiating the investigation.
- January 2026: The three services began enabling malicious messages, targeting over 75,000 organizations and generating tens of millions of dollars for operators.
- Wednesday: Microsoft and Health-ISAC seized and redirected the domains behind YAM Store, CoGUI, and Iron Man, according to a Microsoft statement.
Who is affected
The campaigns targeted consumers, healthcare groups, banks, and other businesses in more than 150 countries. Microsoft stated that more than 750 million of the malicious messages specifically targeted its customers. The services generated tens of millions of dollars for their operators by stealing passwords and payment data. Criminals used this stolen information to buy high-end goods or conduct transactions on financial platforms.
What happens next
Microsoft has disabled more than 20,000 accounts connected to YAM Store. The company acted under an order from the US District Court for the Southern District of Florida. Investigators shared intelligence with the US Secret Service and international law enforcement partners. The collaboration included the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
The background in plain language
Phishing kits are pre-made packages of fake websites and messages designed to steal login credentials or payment details. Cybercriminals often sell these tools online, allowing less technical actors to launch sophisticated attacks. When a vendor seizes the domains hosting these kits, it disconnects the attackers from their infrastructure. This stops active campaigns and prevents new victims from accessing the fraudulent sites linked to those specific addresses.
What to do and how to stay safe: Microsoft
- Monitor email logs for messages originating from domains recently associated with known phishing kits, even if the sender appears legitimate.
- Verify unexpected requests for personal data or payment by contacting the purported organization through official, independent channels.
- Review account activity for unauthorized purchases or login attempts from unfamiliar locations or devices.
- Ensure multi-factor authentication is enabled on all critical business and personal accounts to add a layer of security.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific services were shut down in this operation?
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI, and Iron Man, three Chinese-language cybercrime services.
How many organizations were targeted by these scams?
The services enabled malicious messages targeting over 75,000 organizations worldwide since January 2026.
What was the origin of the investigation?
The investigation began in late 2025 after Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan.
