On Wednesday, Microsoft announced a coordinated takedown of three major phishing platforms operated by Chinese cybercriminals responsible for hundreds of millions of fraudulent messages impersonating more than 75,000 organizations globally. Working alongside Japan's National Police Agency and Health-ISAC, a healthcare-focused cybersecurity organization, Microsoft obtained a U.S. court order to seize and redirect the domains supporting YAM Store, CoGUI and Iron Man.
Since the start of the year, these three platforms have collectively generated more than 750 million messages aimed at Microsoft customers. The fraudulent campaigns have targeted consumers, healthcare providers, financial services firms and enterprises across more than 150 countries, netting tens of millions of dollars for the operators. The primary objective has been harvesting credentials, personal data, banking information and login details.
How the platforms operated
Iron Man functions as a phishing-kit-as-a-service platform, offering more than 2,300 pre-built lure pages mimicking legitimate services including postal operators, traffic authorities, tax bodies, banks and telecommunications providers. Subscribers gain access to thousands of templates customized for Australia, Japan, India and numerous other nations.
CoGUI supplied criminals with ready-to-use websites and messaging templates designed to impersonate recognized brands, companies, government bodies and financial organizations. Though initially concentrated on targeting Japanese users, cybercriminals began migrating to Iron Man by mid-2026, drawn to its capability to "quickly deploy email, text and web content tailored to specific brands, industries and countries."
YAM Store operated as an initial access broker marketplace, functioning as a platform where "infrastructure using compromised or fraudulently obtained environments in providers like Microsoft and Google" could be bought and sold. This allowed scammers to browse and purchase the most economical fraudulent Microsoft and Google accounts for their operations. The marketplace categorized offerings by account age, subscription tier and environment type, including education (.edu) and non-profit (.org) domains.
Criminals exploited expired domains belonging to legitimate companies, reconstructing them as counterfeit sites to harvest Microsoft 365 credentials, which were subsequently resold on YAM Store for profit.
Investigation and enforcement
The investigation commenced when Japanese police flagged messaging campaigns targeting residents of Japan, according to Steven Masada, associate general counsel for Microsoft's Digital Crimes Unit. As Microsoft and Japanese authorities connected multiple scam operations to the same underlying infrastructure, they uncovered the broader Chinese-language cybercrime ecosystem.
Through the court order, Microsoft seized and redirected domains while deactivating more than 20,000 accounts tied to YAM Store. The company continues removing infrastructure hosted on its platforms and has blocked more than 100,000 domains used for impersonation. Microsoft collaborated with cybersecurity firm Resecurity to penetrate the platforms and shared findings with U.S. and international law enforcement.
Masada noted in a blog post that these tools represent "the driving force behind many of the toll scam texts or fake delivery emails people are inundated with on a daily basis." The investigation identified structural similarities between YAM Store, CoGUI and Iron Man, suggesting either close coordination among developers or shared technical origins.
Broader enforcement trend
This action reflects Microsoft's expanding reliance on legal mechanisms to combat phishing infrastructure targeting its credentials. Last month, the company pursued legal action against EvilTokens, an AI-powered cybercriminal platform, obtaining court authorization to take it offline and coordinating with U.K. police to arrest suspected operators.
In June, Microsoft dismantled hundreds of servers and domains associated with cybercrime-as-a-service operations distributing SocGholish, Amadey and StealC malware. Over the past year, the company has also targeted other prominent phishing platforms including RaccoonO365 and RedVDS.
