Microsoft's Digital Crimes Unit and Health-ISAC have seized and redirected domains used by three linked services: YAM Store, CoGUI and Iron Man. Microsoft describes them as part of a Chinese-language cybercrime marketplace where criminals could buy accounts, phishing kits and infrastructure. The action was authorized by an order from the US District Court for the Southern District of Florida. Steven Masada, general manager of Microsoft's Digital Crimes Unit, announced it on October 14.

Microsoft says that since January 2026 the three services together enabled more than 1 billion malicious messages. Those messages targeted more than 75,000 organizations in more than 150 countries, and more than 750 million of them were aimed at Microsoft customers. Microsoft says the operators earned tens of millions of dollars. As part of the disruption, the company disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 impersonation and fraud domains. Microsoft did not say how many domains the court order covered.

Health-ISAC, the information-sharing group for the healthcare sector, joined the civil suit because threat actors often used the infrastructure to target hospitals and healthcare organizations, SecurityWeek reported.

Three services, one supply chain

Masada presented the case as an action against the businesses that supply scammers, not the scam messages themselves. "The scam message is often the only part victims see. The businesses behind it are what make it possible," he wrote in Microsoft's announcement. He added that disrupting the services "makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on."

YAM Store, which Microsoft tracks as Storm-3119, worked "much like an online shop," according to Microsoft. Customers could browse and buy fraudulent Microsoft and Google accounts. Buyers could filter by account age, subscription type and environment, such as education or nonprofit, SecurityWeek reported. Microsoft's threat intelligence team said YAM Store "functions as an access broker" that hijacks Microsoft 365 and Azure for Education accounts and resells them to downstream operations. Microsoft also says operators acquired domains that legitimate organizations had let expire, often in sectors such as nonprofits and education, rebuilt the sites to look active, and used them to obtain Microsoft 365 accounts for sale through YAM Store.

CoGUI and Iron Man are phishing kits. Microsoft tracks them, along with a kit called Haozi, as Storm-2990. The kits supply ready-made websites and messages that impersonate companies. According to SecurityWeek, they also work as live platforms that let operators watch victims in real time and prompt them for one-time verification codes. CoGUI was used heavily against victims in Japan and the US. Microsoft says Iron Man was increasingly replacing it by mid-2026, and SecurityWeek reported that YAM Store began advertising Iron Man in June 2026.

Microsoft's announcement puts Iron Man at more than 2,300 impersonation templates; SecurityWeek, citing Microsoft, reported more than 2,335 templates covering more than 139 countries, with the US having the most. Microsoft says most US lures impersonate transportation and government entities, such as traffic and parking fee authorities. Microsoft says the Iron Man templates impersonate sectors including banks, retailers, healthcare providers, police departments, airlines, telecommunications companies and parcel delivery services.

Microsoft's threat intelligence team assesses with high confidence that Chinese-speaking threat actors developed the kits, SecurityWeek reported. Microsoft cites similar infrastructure and overlapping activity as evidence of shared origins, code reuse or close collaboration.

How the case came together

Microsoft says the investigation began in late 2025, when Japan's National Police Agency (NPA) alerted it to scam campaigns targeting people in Japan. The Japan Cybercrime Control Center (JC3) also took part. Microsoft's other named partners are Health-ISAC, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and the US Secret Service.

Inside the Iron Man kit

Resecurity published a technical report the same day. The firm says it bought an Iron Man license, deployed the kit in an isolated lab and captured its outbound traffic. Resecurity describes the kit as a self-hosted package, distributed as a container image through the vendor's own registry and running on a Go backend. The admin panel is bilingual, with Chinese labels for operators and English interface text. Resecurity counted 2,360 lure templates covering 130 countries or areas, as well as 911 published build versions. The newest template was added on October 1, 2026.

Resecurity's template catalog shows which brands are impersonated most often:

  • DHL: 37 templates
  • DPD: 24
  • Apple: 23
  • GLS: 22
  • Spanish tax authority: 16
  • American Express: 12

The report also explains why the kit depends on the vendor. In the lab, the panel polled a local license-status endpoint about every 20 seconds, and each poll triggered a request to the vendor's authorization host. Resecurity concluded that "the panel cannot operate without regular contact with vendor infrastructure." It says disrupting or sinkholing that host would degrade every active deployment at once, and it recommends a coordinated takedown of the licensing host and the registry.

Resecurity says its HUNTER team infiltrated communities managed by Chinese threat actors. The firm links the infrastructure to a single persistent group with medium confidence, based on infrastructure and registry evidence. It says no real-world identity has been confirmed for any operator account.

What It Means for Defenders

  • Audit Microsoft 365 and Azure tenants for accounts you did not create. Education and nonprofit tenants in particular should review recently added users, unexpected mail-sending volume and new app registrations.
  • Track your lapsed domains. Check whether anyone has re-registered domains your organization let expire, especially ones that were ever used for email or identity. Consider renewing such domains instead of letting them lapse.
  • Do not trust mail just because it passes authentication. Mail sent from a hijacked but legitimate account can pass SPF and DKIM checks. Content and behavioral filtering for parcel, toll, tax and bank themes should still apply to it.
  • Brief staff and patients on one-time-code requests. These kits can prompt victims for verification codes in real time. Healthcare organizations should warn that no legitimate toll, delivery or billing notice will ask for a login code. Health-ISAC members should check the group's channels for indicators tied to the case.
  • Use the published research. Add any indicators from Resecurity's report and Microsoft's threat intelligence to blocklists and mail-filtering rules, and defang them when sharing internally.

Sources