# Microsoft and Health-ISAC Seize Domains Behind YAM Store Phishing Kits

- URL: https://usa-24.com/yam-store-phishing-takedown/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-15T19:02:19.090Z
- Updated: 2026-10-15T19:02:19.098Z
- Topics: Phishing, Microsoft, Cybercrime, Domain Seizure, Health-ISAC

> Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, which sold phishing kits and stolen accounts. Microsoft says they enabled over 1 billion malicious messages.

## Key takeaways

- Microsoft and Health-ISAC seized and redirected domains used by YAM Store, CoGUI and Iron Man, announced on Wednesday, October 14, 2026.
- Microsoft says the services enabled more than 1 billion malicious messages aimed at more than 75,000 organizations worldwide since January 2026.
- Microsoft disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
- The action rested on an order from the U.S. District Court for the Southern District of Florida, and Health-ISAC joined the civil lawsuit.
- Microsoft's count measures messages enabled by the services, not confirmed victims, and the sources reviewed report no arrests tied to the operators.

Microsoft and Health-ISAC have seized and redirected the domains behind a court-backed YAM Store phishing takedown. The action also hit CoGUI and Iron Man, two linked services that sold ready-made phishing kits, stolen Microsoft and Google accounts and impersonation templates to scammers. Microsoft announced it on Wednesday, October 14, 2026, and says the services enabled more than 1 billion malicious messages.

The case matters for two reasons. It rests on a federal court order rather than a private blocklist, which gives the seizure legal force that a voluntary takedown lacks. It also has a direct U.S. angle, because the services were used against American organizations and consumers. Microsoft says the work is not finished and that it is still removing infrastructure hosted on its own services.

## What Microsoft and Health-ISAC seized

According to [SecurityWeek](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/), Microsoft and Health-ISAC seized and redirected domains used by YAM Store, CoGUI and Iron Man. Microsoft describes the three as components of a Chinese-language cybercrime marketplace that supplied accounts, phishing kits and infrastructure to criminals.

The action rested on an order from the U.S. District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit because criminals frequently used this infrastructure to target hospitals and healthcare organizations, which gave the group a direct stake in the outcome.

[The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms) reports that Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. Those numbers are the clearest measure so far of what the court-backed action has changed.

## How the YAM Store marketplace worked

YAM Store operated like an online shop. [Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/) reports that it sold fraudulent Microsoft and Google accounts along with tools for credential theft. Its operators bought expired domains, including ones once used by nonprofits and schools, rebuilt the sites and used them to obtain Microsoft 365 accounts for resale.

That supply chain explains why an old school or charity domain can stay dangerous long after its original owner walks away. A domain with a history looks more trustworthy to a mail filter and to a person skimming a login page. Buying one is far cheaper than building trust from scratch.

CoGUI and Iron Man played a different part. According to [TRM Labs](https://www.trmlabs.com/resources/blog/trm-supports-takedown-of-chinese-language-cybercrime-ecosystem-with-microsoft-health-isac-and-others), they supplied ready-made phishing sites and impersonation templates. A buyer did not need to design a convincing sign-in page or copy a brand's layout, because the kit did that work.

The pattern is familiar. Criminals buy or abuse expired domains and cloud accounts, then sell them as ready-made access. [iTechPost](https://www.itechpost.com/articles/237569/20261015/microsoft-leads-major-takedown-japan-against-massive-phishing-scam-network.htm) reports Microsoft's account that reselling fraudulent accounts lets other criminals reach cloud services without building their own. That split of labor, with one group acquiring access and another running the scam, is what makes marketplaces like this hard to dismantle one scam at a time.

## Key numbers and what they actually measure

The figures are large, but they describe something narrower than victims. Microsoft's count reflects messages enabled by these services, not completed scams or confirmed losses. [The Hack Academy](https://www.thehackacademy.com/microsoft-health-isac-phishing-domain-seizure.htm) stresses that distinction.

| Measure | Figure |
|---|---|
| Messages enabled since January 2026 | More than 1 billion |
| Organizations targeted worldwide | More than 75,000 |
| Messages aimed at Microsoft customers | More than 750 million |
| Countries affected, per Microsoft | More than 150 |
| YAM Store accounts disabled | More than 20,000 |
| Domains being blocked | More than 100,000 |

Microsoft's tracking name for YAM Store is Storm-3119, according to SecurityWeek and The Hack Academy. The lavx.hu reprint of Microsoft's post uses Storm-2990 for the wider operation, so the naming is inconsistent across reports and should be treated as unresolved.

## How the investigation started and who led it

The case began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns aimed at people in Japan. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort, along with U.S. and international law enforcement.

Attribution is less settled. Sources differ on which agencies led the work, with some crediting Japan's police and others crediting Microsoft and Health-ISAC. The public reporting does not yet spell out how those roles fit together.

Steven Masada, general counsel and general manager of Microsoft's Digital Crimes Unit, put the stakes in a blog post. A simple scam message, he wrote, is often "the visible end of a much larger transnational cybercriminal operation." The quote is as reproduced by [lavx.hu](https://news.lavx.hu/article/microsoft-and-partners-dismantle-chinese-language-phishing-kit-operation).

The targets were primarily in the United States and Japan. [CyberScoop](https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/) reports that they spanned healthcare, financial services, logistics and IT.

## What the YAM Store phishing takedown means for you

Microsoft and its partners get a clear result: the infrastructure is offline, and the operators have lost the domains they relied on. Victims get less immediate relief. The people most exposed are U.S. organizations using Microsoft 365 or Google accounts, because the marketplace sold access to exactly those accounts and aimed at healthcare, finance and logistics firms.

Consumers will recognize the other side of the problem. [The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms) reports that Masada has said these tools drive many of the toll-scam texts and fake delivery emails people receive daily. A message asking you to pay a small road toll or confirm a package through a login page may have been built from a kit like these.

Impersonation templates are the product being sold, so the lure can look like a company you already trust rather than an unknown sender.

## What to do now

These steps are general security guidance rather than recommendations from the sources, but they map directly onto the tactics described above.

- Enforce phishing-resistant multi-factor authentication, such as passkeys or hardware security keys, on Microsoft 365 and Google accounts.
- Audit any abandoned or expired domains your organization used, since attackers buy those to rebuild sites that look trusted.
- Treat toll and delivery texts that ask you to log in as suspicious. Open the carrier's or toll authority's official app, or type its address yourself, instead of tapping the link.
- Report scams to the Federal Trade Commission at reportfraud.ftc.gov.

## What comes next

The sources do not report any arrests or charges tied to YAM Store, CoGUI or Iron Man operators. Attribution is contested, the naming conflict is unresolved, and Microsoft says the scope may grow. Those gaps are the open questions for the next stage of the case.

The Justice Department has used a similar mix of charges and device seizures elsewhere. It charged 14 people and seized 187 devices in a crackdown on North Korean IT worker schemes, as [USA 24 detailed](https://usa-24.com/north-korean-it-worker-laptop-farms/). Microsoft is also racing a CISA deadline over an exploited Windows flaw, as [USA 24 reported](https://usa-24.com/windows-shell-vulnerability-patch-deadline/).

A separate federal case also surfaced this week. The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on extortion charges tied to its investigation of ShinyHunters, according to [CyberScoop](https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/). It is not part of the Microsoft action, but both cases show federal prosecutors and private firms targeting criminal infrastructure at the same time.

For now, the seized domains are the visible result. The harder test is whether the resellers rebuild under new names, since expired domains and cloud accounts are cheap to acquire. Watch the court docket in Florida, any statement from Japan's police, and Microsoft's removal updates to see whether the next wave of kits arrives before the next filing.

## Frequently asked questions

### What is YAM Store?

According to Hackread, YAM Store operated like an online shop selling fraudulent Microsoft and Google accounts and tools for credential theft. Its operators bought expired domains, including ones once used by nonprofits and schools, and rebuilt them to obtain Microsoft 365 accounts for resale. Microsoft says it disabled more than 20,000 accounts tied to the service.

### Were any arrests made in the YAM Store phishing takedown?

The sources reviewed do not report any arrests or charges tied to YAM Store, CoGUI or Iron Man operators. The action was a court-backed seizure and redirection of domains, so the people behind the services remain unidentified in these reports.

### Does the 1 billion message figure mean 1 billion victims?

No. Microsoft's figure counts messages enabled by the services since January 2026, not completed scams or confirmed victims. The Hack Academy stresses this distinction, and readers should treat the number as a measure of reach rather than losses.

### How can I tell if a toll text is a phishing scam?

Treat any toll or delivery text that asks you to log in as suspicious, and do not tap the link. Open the carrier's or toll authority's official app or type its address yourself. You can report suspicious messages to the FTC at reportfraud.ftc.gov.

### Who is most at risk from these phishing kits?

Targets were primarily in the United States and Japan, across healthcare, financial services, logistics and IT. U.S. organizations using Microsoft 365 or Google accounts are most exposed, because the marketplace sold access to those accounts.

## Sources

1. [Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages — SecurityWeek](https://www.securityweek.com/microsoft-disrupts-chinese-language-phishing-market-behind-1b-messages/)
2. [Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals — The Record](https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms)
3. [TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man — TRM Labs](https://www.trmlabs.com/resources/blog/trm-supports-takedown-of-chinese-language-cybercrime-ecosystem-with-microsoft-health-isac-and-others)
4. [Microsoft and partners dismantle Chinese-language phishing kit operation — lavx.hu](https://news.lavx.hu/article/microsoft-and-partners-dismantle-chinese-language-phishing-kit-operation)
5. [Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages — Hackread](https://hackread.com/microsoft-seizes-yam-store-phishing-kit-domains/)
6. [Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem — CyberScoop](https://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/)
7. [Microsoft Leads Major Takedown With Japan Against Massive Phishing Scam Network — iTechPost](https://www.itechpost.com/articles/237569/20261015/microsoft-leads-major-takedown-japan-against-massive-phishing-scam-network.htm)
8. [Microsoft, Health-ISAC seize phishing domains by court order — The Hack Academy](https://www.thehackacademy.com/microsoft-health-isac-phishing-domain-seizure.htm)
9. [Canadian cybersecurity executive arrested in federal extortion case — CyberScoop](https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/)