Microsoft Seizes Domain Infrastructure Behind 1 Billion Phishing Messages

Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) have seized and redirected domains supporting three Chinese-language cybercrime operations responsible for sending more than 1 billion malicious messages since January 2026, according to reporting by The Next Web (https://thenextweb.com/news/microsoft-yam-store-cogui-iron-man-phishing-kits-1bn-messages). The disruption was carried out under an order issued by the U.S. District Court for the Southern District of Florida, targeting infrastructure linked to services known as YAM Store, CoGUI, and Iron Man.

The phishing campaigns reached over 75,000 organizations across more than 150 countries, targeting consumers, healthcare providers, banks, and enterprise businesses. Microsoft stated that more than 750 million of the malicious messages directly targeted its customer base. The operations generated tens of millions of dollars for their operators, who Microsoft assesses with high confidence to be Chinese-speaking threat actors seeking stolen credentials and payment data to make unauthorized financial transactions and purchase high-end goods.

The investigation originated in late 2025 after Japan’s National Police Agency alerted Microsoft to phishing campaigns aimed at Japanese citizens. The probe subsequently expanded into a multi-party coalition that included the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, the U.S. Secret Service, and international law enforcement agencies.

The targeted operations performed distinct roles within the cybercrime ecosystem. YAM Store functioned as an e-commerce platform where buyers could browse and purchase fraudulent Google and Microsoft accounts alongside ready-made scam tools. To obtain Microsoft 365 accounts for resale, its operators acquired expired domain names formerly owned by schools and non-profit organizations and rebuilt their websites. The platform accepted payment via Alipay, WeChat Pay, and the cryptocurrency USDT.

CoGUI and Iron Man provided phishing distribution assets, supplying pre-packaged websites and messages that impersonated trusted institutions. By mid-2026, Iron Man largely began replacing CoGUI, with investigators identifying more than 2,300 templates mimicking banks, retailers, healthcare providers, police departments, and government bodies. In the United States, Iron Man campaigns primarily used lures involving municipal transportation and government fees, such as parking and traffic citations.

Alongside the domain seizures, Microsoft disabled more than 20,000 accounts linked to YAM Store and is blocking over 100,000 domains used for impersonation and fraud. Steven Masada, general manager of Microsoft’s Digital Crimes Unit, noted that while the three services represent only a segment of a broader criminal network, taking down their infrastructure restricts access to the tooling and accounts threat actors depend on.