# Microsoft Takes Down YAM Store, CoGUI and Iron Man Phishing Kits

- URL: https://usa-24.com/yam-store-phishing-takedown-2/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-18T15:13:35.416Z
- Updated: 2026-10-18T15:13:35.422Z
- Topics: Phishing, Microsoft 365, Cybercrime, Domain Seizure, Account Takeover

> Microsoft and Health-ISAC seized domains behind three Chinese-language phishing services tied to more than one billion scam messages, cutting off a marketplace for fake Microsoft and Google accounts.

## Key takeaways

- Microsoft and Health-ISAC redirected domains used by YAM Store, CoGUI and Iron Man under an order from the U.S. District Court for the Southern District of Florida.
- The three services enabled more than 1 billion malicious messages targeting over 75,000 organizations worldwide since January 2026.
- YAM Store sold fraudulent Microsoft and Google accounts, and operators reportedly reused expired nonprofit and school domains to obtain Microsoft 365 accounts for resale.
- Microsoft says it has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
- The services accepted USDT on the Tron network and ETH, but the dollar value of the frozen assets has not been disclosed.

Microsoft and Health-ISAC have seized and redirected the web domains behind three Chinese-language phishing services, and the YAM Store phishing takedown cut off a marketplace tied to more than one billion scam messages. Microsoft announced the action on Wednesday, October 14, after the U.S. District Court for the Southern District of Florida issued an order allowing the domains to be taken over.

It is a rare example of a court-backed, public-private disruption aimed at the supply chain behind phishing. The targets were YAM Store, CoGUI and Iron Man, and the goods they sold, including accounts and phishing kits, feed directly into Microsoft 365 and Google account abuse.

## What the court order allowed Microsoft and Health-ISAC to do

The seizure rested on the federal order from the Southern District of Florida, as [SecurityWeek](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/) reported. Health-ISAC, a health-sector sharing group, co-led the action with Microsoft. Redirecting the domains means buyers can no longer reach the storefronts and kits they used.

Microsoft's post, as relayed by [SecurityOnline](https://securityonline.info/cogui-phishing-kit-takedown/), also names Resecurity, Cloudflare, Oracle and Proofpoint as partners. The reports do not spell out what each partner did, so readers should treat those roles as Microsoft's account rather than independently confirmed detail.

## How YAM Store, CoGUI and Iron Man sold phishing to criminals

YAM Store operated like a storefront. In its investigation post, Microsoft wrote that "YAM Store operated much like an online shop," as [Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/) quoted it. The shop sold fraudulent Microsoft and Google accounts along with tools for credential theft and other scams, according to [Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/).

The account-making process was the most damaging part. Operators reportedly bought expired domains belonging to real nonprofits and schools, rebuilt the sites, and used them to obtain Microsoft 365 accounts for resale, according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/). A familiar nonprofit or school name lends credibility to an account that criminals then sell on.

Iron Man and CoGUI handled the lure side. They supplied ready-made messages and phishing pages that imitate government agencies, transport authorities, retailers and banks, as [Currency Analytics](https://thecurrencyanalytics.com/altcoins/microsoft-seizes-usdt-phishing-domains-75000-firms-304179) reported. Microsoft counted more than 2,300 Iron Man templates impersonating organizations in more than 150 countries, according to [Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/).

Consumers may recognize the output. Fake delivery texts and toll-scam messages often rely on this kind of infrastructure, and one researcher cited by [The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms) links the tools to many such scam texts. Microsoft framed the stakes this way: "What appears to be a simple scam message is often the visible end" of a bigger operation, as [The Next Web](https://thenextweb.com/news/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages) reported.

## Scale of the operation and how investigators found it

- More than 1 billion malicious messages since January 2026, targeting over 75,000 organizations worldwide ([The Next Web](https://thenextweb.com/news/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages)).
- More than 750 million of those messages targeted Microsoft customers ([Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/)).
- More than 150 countries affected ([Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/), [KuCoin](https://kucoin.com/news/flash/microsoft-and-partners-take-down-phishing-network-accepting-usdt-payments)).
- More than 20,000 accounts tied to YAM Store disabled ([Help Net Security](https://www.helpnetsecurity.com/2026/10/15/microsoft-disrupting-phishing-kits-marketplace-yam-store/), [Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/)).
- More than 100,000 domains blocked for impersonation and fraud ([Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/), [The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms)).

These figures reflect Microsoft's account as reported by security outlets. The sources reviewed do not include an independent count, so treat the numbers as the company's own measurements.

The investigation started in Japan. According to Microsoft's account as reported by one outlet, Japan's National Police Agency alerted the company to scam campaigns targeting people in Japan ([The Next Web](https://thenextweb.com/news/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages), [Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/)). Microsoft now tracks the activity under two names: Storm-3119 for YAM Store, and Storm-2990 for the CoGUI, Haozi and Iron Man kits ([BleepingComputer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/)).

## Crypto payments and the money trail

The services accepted cryptocurrency, including USDT on the Tron network and ETH. Investigators also found that TRM Labs helped freeze related assets, according to [KuCoin](https://kucoin.com/news/flash/microsoft-and-partners-take-down-phishing-network-accepting-usdt-payments). The dollar value of those frozen assets has not been disclosed.

One secondary report says the operators earned tens of millions of dollars. That estimate does not appear in the Microsoft material reviewed, so it needs a primary source before anyone relies on it ([The Currency Analytics](https://thecurrencyanalytics.com/altcoins/microsoft-seizes-usdt-phishing-domains-75000-firms-304179)).

## Who is most exposed to account takeover

U.S. businesses running Microsoft 365 or Google Workspace face the most direct risk. The accounts these services sold give attackers a login that belongs to a real tenant, which makes a phishing email far more convincing than a generic lure ([BleepingComputer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/)).

Nonprofits and schools whose expired domains were reused face reputational and phishing risk, since their names can appear on messages they never sent. Healthcare organizations sit inside the target base, which is why Health-ISAC joined the action ([SecurityWeek](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/), [Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/)).

Our earlier report on a [compromised ConnectWise credential that opened 173 Microsoft 365 tenants](https://usa-24.com/connectwise-cloud-backup-breach/) shows how one stolen login can reach many organizations at once.

The same week, a separate federal action targeted North Korean remote-IT-worker schemes. A four-count indictment described a multi-year fraud that generated over $3 million in fraudulent revenue, as [SecurityWeek](https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/) reported. That is state-linked employment fraud, not consumer phishing, so it belongs in its own story.

## What to do now if you run Microsoft 365 or Google accounts

- Enforce phishing-resistant multi-factor authentication, such as security keys or passkeys, on every Microsoft 365 and Google account.
- Audit OAuth app grants and license assignments, and investigate any you cannot explain.
- Warn staff that attackers may impersonate your own vendors, as well as government agencies and banks.

Consumers should treat unexpected delivery, account or toll texts as suspect, avoid tapping links in them, and report them to the FTC at reportfraud.ftc.gov. Impersonation is a recurring theme this year. The [FBI has warned that scammers are exploiting the 2026 midterm election](https://usa-24.com/fbi-midterm-election-scam-warning/), using the same tactic of posing as official senders.

## What to watch next

Several questions remain open. The sources do not say whether the operators will rebuild under new domains or names, although Microsoft says it is still removing infrastructure ([Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/), [The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms)). The value of the frozen assets is still unknown, and no U.S. arrests tied to YAM Store appear in the reports reviewed.

The next signal will come from the domains themselves. If the three services return under new names, the seizure will have bought time rather than ended the trade. Security teams should watch sign-in logs for the impersonation patterns Microsoft described and for any new kit names that appear in the coming weeks.

## Frequently asked questions

### What is YAM Store?

YAM Store was a Chinese-language storefront within a cybercrime marketplace. It sold fraudulent Microsoft and Google accounts along with tools for credential theft and other scams. Microsoft tracks it as Storm-3119, and its domains were seized and redirected in October 2026.

### Is YAM Store legal?

No. The operation was described as a cybercrime marketplace, and the seizure rested on a U.S. federal court order. The reports reviewed mention no U.S. arrests tied to YAM Store, so the criminal case is still open.

### How can I tell if my Microsoft 365 account was targeted?

Review OAuth app grants and license assignments for activity you do not recognize. Enforce phishing-resistant multi-factor authentication to reduce the value of stolen passwords. Treat any unexpected sign-in request as a possible compromise and report it to your IT team.

### Where should I report phishing texts about deliveries or tolls?

Report them to the Federal Trade Commission at reportfraud.ftc.gov. Do not tap links in unexpected delivery, account or toll texts. Delete the message after reporting it.

## Sources

1. [Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages — SecurityWeek](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/)
2. [Microsoft disrupts phishing network behind more than a billion scam messages — Help Net Security](https://www.helpnetsecurity.com/2026/10/15/microsoft-disrupting-phishing-kits-marketplace-yam-store/)
3. [Microsoft, Health-ISAC dismantle phishing infrastructure targeting critical infrastructure, healthcare sector — Industrial Cyber](https://industrialcyber.co/medical/microsoft-health-isac-dismantle-phishing-infrastructure-targeting-critical-infrastructure-healthcare-sector/)
4. [Microsoft disrupts Chinese-language phishing kits behind 1bn scam messages — The Next Web](https://thenextweb.com/news/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages)
5. [Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages — Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/)
6. [Global takedown hits network behind 1 billion phishing messages — BleepingComputer](https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/)
7. [Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals — The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms)
8. [Microsoft and Partners Take Down Phishing Network Accepting USDT Payments — KuCoin news flash](https://kucoin.com/news/flash/microsoft-and-partners-take-down-phishing-network-accepting-usdt-payments)
9. [Microsoft Takes Down USDT-Funded Phishing Network Targeting 75,000 Companies — The Currency Analytics](https://thecurrencyanalytics.com/altcoins/microsoft-seizes-usdt-phishing-domains-75000-firms-304179)
10. [Microsoft and Proofpoint Disrupt CoGUI Phishing Kit, YAM Store, and Iron Man — SecurityOnline](https://securityonline.info/cogui-phishing-kit-takedown/)
11. [US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms — SecurityWeek](https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/)