Microsoft and Health-ISAC have seized and redirected the domains behind a court-backed YAM Store phishing takedown. The action also hit CoGUI and Iron Man, two linked services that sold ready-made phishing kits, stolen Microsoft and Google accounts and impersonation templates to scammers. Microsoft announced it on Wednesday, October 14, 2026, and says the services enabled more than 1 billion malicious messages.
The case matters for two reasons. It rests on a federal court order rather than a private blocklist, which gives the seizure legal force that a voluntary takedown lacks. It also has a direct U.S. angle, because the services were used against American organizations and consumers. Microsoft says the work is not finished and that it is still removing infrastructure hosted on its own services.
What Microsoft and Health-ISAC seized
According to SecurityWeek, Microsoft and Health-ISAC seized and redirected domains used by YAM Store, CoGUI and Iron Man. Microsoft describes the three as components of a Chinese-language cybercrime marketplace that supplied accounts, phishing kits and infrastructure to criminals.
The action rested on an order from the U.S. District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit because criminals frequently used this infrastructure to target hospitals and healthcare organizations, which gave the group a direct stake in the outcome.
The Record reports that Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud. Those numbers are the clearest measure so far of what the court-backed action has changed.
How the YAM Store marketplace worked
YAM Store operated like an online shop. Hackread reports that it sold fraudulent Microsoft and Google accounts along with tools for credential theft. Its operators bought expired domains, including ones once used by nonprofits and schools, rebuilt the sites and used them to obtain Microsoft 365 accounts for resale.
That supply chain explains why an old school or charity domain can stay dangerous long after its original owner walks away. A domain with a history looks more trustworthy to a mail filter and to a person skimming a login page. Buying one is far cheaper than building trust from scratch.
CoGUI and Iron Man played a different part. According to TRM Labs, they supplied ready-made phishing sites and impersonation templates. A buyer did not need to design a convincing sign-in page or copy a brand's layout, because the kit did that work.
The pattern is familiar. Criminals buy or abuse expired domains and cloud accounts, then sell them as ready-made access. iTechPost reports Microsoft's account that reselling fraudulent accounts lets other criminals reach cloud services without building their own. That split of labor, with one group acquiring access and another running the scam, is what makes marketplaces like this hard to dismantle one scam at a time.
Key numbers and what they actually measure
The figures are large, but they describe something narrower than victims. Microsoft's count reflects messages enabled by these services, not completed scams or confirmed losses. The Hack Academy stresses that distinction.
| Measure | Figure |
|---|---|
| Messages enabled since January 2026 | More than 1 billion |
| Organizations targeted worldwide | More than 75,000 |
| Messages aimed at Microsoft customers | More than 750 million |
| Countries affected, per Microsoft | More than 150 |
| YAM Store accounts disabled | More than 20,000 |
| Domains being blocked | More than 100,000 |
Microsoft's tracking name for YAM Store is Storm-3119, according to SecurityWeek and The Hack Academy. The lavx.hu reprint of Microsoft's post uses Storm-2990 for the wider operation, so the naming is inconsistent across reports and should be treated as unresolved.
How the investigation started and who led it
The case began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns aimed at people in Japan. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort, along with U.S. and international law enforcement.
Attribution is less settled. Sources differ on which agencies led the work, with some crediting Japan's police and others crediting Microsoft and Health-ISAC. The public reporting does not yet spell out how those roles fit together.
Steven Masada, general counsel and general manager of Microsoft's Digital Crimes Unit, put the stakes in a blog post. A simple scam message, he wrote, is often "the visible end of a much larger transnational cybercriminal operation." The quote is as reproduced by lavx.hu.
The targets were primarily in the United States and Japan. CyberScoop reports that they spanned healthcare, financial services, logistics and IT.
What the YAM Store phishing takedown means for you
Microsoft and its partners get a clear result: the infrastructure is offline, and the operators have lost the domains they relied on. Victims get less immediate relief. The people most exposed are U.S. organizations using Microsoft 365 or Google accounts, because the marketplace sold access to exactly those accounts and aimed at healthcare, finance and logistics firms.
Consumers will recognize the other side of the problem. The Record reports that Masada has said these tools drive many of the toll-scam texts and fake delivery emails people receive daily. A message asking you to pay a small road toll or confirm a package through a login page may have been built from a kit like these.
Impersonation templates are the product being sold, so the lure can look like a company you already trust rather than an unknown sender.
What to do now
These steps are general security guidance rather than recommendations from the sources, but they map directly onto the tactics described above.
- Enforce phishing-resistant multi-factor authentication, such as passkeys or hardware security keys, on Microsoft 365 and Google accounts.
- Audit any abandoned or expired domains your organization used, since attackers buy those to rebuild sites that look trusted.
- Treat toll and delivery texts that ask you to log in as suspicious. Open the carrier's or toll authority's official app, or type its address yourself, instead of tapping the link.
- Report scams to the Federal Trade Commission at reportfraud.ftc.gov.
What comes next
The sources do not report any arrests or charges tied to YAM Store, CoGUI or Iron Man operators. Attribution is contested, the naming conflict is unresolved, and Microsoft says the scope may grow. Those gaps are the open questions for the next stage of the case.
The Justice Department has used a similar mix of charges and device seizures elsewhere. It charged 14 people and seized 187 devices in a crackdown on North Korean IT worker schemes, as USA 24 detailed. Microsoft is also racing a CISA deadline over an exploited Windows flaw, as USA 24 reported.
A separate federal case also surfaced this week. The FBI arrested Canadian cybersecurity executive Edward Dubrovsky on extortion charges tied to its investigation of ShinyHunters, according to CyberScoop. It is not part of the Microsoft action, but both cases show federal prosecutors and private firms targeting criminal infrastructure at the same time.
For now, the seized domains are the visible result. The harder test is whether the resellers rebuild under new names, since expired domains and cloud accounts are cheap to acquire. Watch the court docket in Florida, any statement from Japan's police, and Microsoft's removal updates to see whether the next wave of kits arrives before the next filing.
