Press play to start listening
Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI and Iron Man, services that enabled over 1 billion malicious messages since January 2026.
Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) have seized and redirected internet domains supporting a Chinese-language cybercrime marketplace that supplied cybercriminals with fraudulent accounts, phishing kits and infrastructure.
The court-authorized operation targets three components of the network: YAM Store, CoGUI and Iron Man. Since January 2026, the services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages targeting Microsoft customers. The campaigns have affected consumers and organizations in over 150 countries.
Marketplace Supplies Accounts and Phishing Tools
The investigation began in late 2025 after Japan’s National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. Investigators traced the activity to an interconnected marketplace supplying tools and services that criminals could use to conduct fraud and steal credentials.
YAM Store functioned like an online shop, selling fraudulent Microsoft and Google accounts and tools for credential theft and other scams. Investigators found that its operators also bought expired domains, including those previously used by nonprofits and educational institutions. They rebuilt the websites and used them to obtain Microsoft 365 accounts for resale.
CoGUI offered criminals ready-made websites and messages that impersonated legitimate businesses, banks and government agencies. These tools made it easier to set up fake pages to steal login credentials, payment information and other personal data.
By mid-2026, criminals were increasingly turning to Iron Man instead of CoGUI. Investigators found more than 2,300 templates impersonating organizations in over 150 countries. The templates covered a wide range of targets, from banks and retailers to healthcare providers, delivery services and government agencies, and were used in scams involving stolen credentials, fraudulent payments and government impersonation.
Court-Ordered Takedown
Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains associated with the three services. Microsoft has also disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The investigation involved Japan’s NPA, the Japan Cybercrime Control Center (JC3), the U.S. Secret Service and cybersecurity companies including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
Microsoft said the operation reflects a broader trend in which criminal services help fraudsters reach more victims. Although the takedown disrupts infrastructure supporting the three services, Microsoft believes that they form part of a wider criminal network.
“Modern fraud increasingly relies on businesses and services that make it easier for criminals to reach more victims,” Microsoft noted in its official report on the operation.
Expert’s Commentary
Sina Chehreghani, Head of Threat Intel and Threat Research at Securonix, shared with Hackread.com that the scale of the operation reflects a criminal service economy designed to make attacks easier to launch and repeat.
“That volume reflects a service economy built to lower the effort required to launch and repeat campaigns,” Chehreghani said. He added that Health-ISAC’s involvement highlights the risks to hospitals and healthcare organizations, where compromised accounts can expose sensitive information and disrupt essential operations.
Chehreghani cautioned that the takedown does not necessarily mean all related activity has stopped. “A takedown gives defenders useful intelligence, but it does not confirm that every exposed account or related campaign has been contained.”
He advised security teams to use indicators shared by Microsoft and Health-ISAC to review sign-in activity, inbox rules, forwarding changes, consent grants and suspicious access to cloud applications.
“Security teams should use the indicators shared by Microsoft and Health-ISAC to review sign-in activity, inbox rules, forwarding changes, consent grants and suspicious access to cloud applications. They should also look for attempts to reuse compromised accounts or shift to replacement domains and infrastructure. Threat intelligence is most useful when it reaches detection and investigation workflows quickly, giving analysts context to connect current alerts with activity tied to the disrupted services.”
