# Court Order Shuts Down YAM Store, CoGUI and Iron Man Phishing Infrastructure

Microsoft obtained a court order to seize domains powering three phishing platforms that Chinese cybercriminals used to send hundreds of millions of credential-theft messages. The platforms, YAM Store, CoGUI and Iron Man, collectively enabled more than 750 million phishing attempts against Microsoft customers alone since January. Microsoft worked with Japan's National Police Agency and healthcare cybersecurity group Health-ISAC to redirect the infrastructure, which had targeted people and organizations in over 150 countries.

## How the platforms operated

Each platform served a distinct role in credential theft. Iron Man offered phishing-kit-as-a-service with more than 2,300 pre-built templates impersonating postal companies, tax agencies, banks and telecom providers in dozens of countries. CoGUI provided ready-made websites and messages for impersonating trusted brands and government agencies, heavily targeting people in Japan before criminals shifted to Iron Man.

YAM Store functioned as an initial access broker marketplace selling fraudulently obtained or compromised accounts from Microsoft and Google. Cybercriminals could browse for accounts sorted by age, subscription type and domain suffix. The marketplace also sold expired domain names that criminals rebuilt to resemble legitimate organizations, then used those sites to harvest Microsoft 365 credentials for resale.


## Scale and revenue

The three platforms generated tens of millions of dollars for their operators, according to Microsoft. They targeted consumers, healthcare organizations, financial institutions and businesses in more than 150 countries. The majority of messages aimed to steal credentials, personal information and banking data. Microsoft's disruption disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 domains used for impersonation. The company stated it is still removing infrastructure hosted on its own services.


## Discovery trail

Japanese police officials flagged messaging campaigns targeting people in Japan last year, prompting the investigation. Microsoft's Digital Crimes Unit traced the campaigns to a Chinese-language cybercrime ecosystem centered on CoGUI. As researchers linked multiple scam campaigns to the same infrastructure, they identified YAM Store as the source of fraudulent accounts and domains. Microsoft noted structural similarities among the three platforms, suggesting close collaboration among developers or shared development origins. The company worked with cybersecurity firm Resecurity to infiltrate the sites and shared findings with U.S. and international law enforcement.


## Legal mechanism

Microsoft obtained a U.S. court order authorizing the seizure and redirection of domains underlying the platforms. This legal approach allowed the company to take control of the infrastructure. Microsoft has used similar court orders to dismantle RaccoonO365, RedVDS and AI-powered platform EvilTokens over the past year. In June, the company dismantled hundreds of servers and domains tied to SocGholish, Amadey and StealC malware.


## Impact on phishing volume

The platforms were the driving force behind many toll scam texts and fake delivery emails people receive daily, according to Microsoft. Iron Man's templates allowed criminals to quickly deploy email, text and web content tailored to specific brands, industries and countries. Microsoft stated it is removing remaining infrastructure on its services and working with international law enforcement partners on follow-up actions.


## What to watch for

Organizations can verify whether domains in suspicious messages match official company domains by checking the sender address carefully. Enable multi-factor authentication on all accounts so that stolen passwords alone do not grant access. Treat urgent requests for credentials or personal information as suspect, particularly those arriving by text or email claiming to be from postal services, tax agencies or financial institutions.
1. Check the sender domain carefully against the official organization domain.
2. Do not click links or reply with personal information.
3. Navigate directly to the organization's official website by typing the address yourself.
4. Enable multi-factor authentication on accounts.

## How did Microsoft take control of the phishing platforms?

Microsoft obtained a U.S. court order authorizing the seizure and redirection of domains underlying YAM Store, CoGUI and Iron Man. The company worked with Japan's National Police Agency and Health-ISAC to execute the action, which also disabled more than 20,000 accounts connected to YAM Store.

## What did YAM Store sell to cybercriminals?

YAM Store functioned as a marketplace for compromised or fraudulently obtained Microsoft and Google accounts. Cybercriminals could purchase accounts sorted by age, subscription type and domain suffix. The marketplace also sold expired domain names that criminals used to rebuild legitimate-looking phishing sites.

## How many phishing messages did the platforms enable?

The three platforms collectively enabled more than 750 million phishing messages targeting Microsoft customers alone since January. The attacks targeted people and organizations in over 150 countries and generated tens of millions of dollars for the operators.

## Does this disruption stop phishing attempts?

The takedown removes three infrastructure providers but other platforms continue to operate. Criminals may migrate to alternatives or rebuild tools. Organizations and individuals should maintain credential security practices regardless of enforcement actions against specific platforms.

## What should I do if I receive a suspicious message claiming to be from a postal service or tax agency?

Check the sender domain carefully against the official organization domain. Do not click links or reply with personal information. Navigate directly to the organization's official website by typing the address yourself. If multi-factor authentication is available for the account in question, enable it.

Source: The Record
Published: 2026-10-15T01:25:42+00:00