Microsoft and Health-ISAC have shut down and redirected domains belonging to three Chinese-language cybercrime operations—YAM Store, CoGUI and Iron Man—following a coordinated investigation that began with a tip from Japan's National Police Agency. The three platforms facilitated the distribution of more than 1 billion malicious messages targeting in excess of 75,000 organisations globally from January 2026 onward.

The fraudulent messages, which offered templates mimicking banks, law enforcement agencies and delivery companies, struck over 750 million times at Microsoft customers alone. Victims across more than 150 nations—including consumers, healthcare institutions, financial organisations and other enterprises—fell prey to the schemes, which generated tens of millions of dollars for the perpetrators.

What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.

Steven Masada, general manager of Microsoft's Digital Crimes Unit

Investigation origins in Japan

The probe commenced in late 2025 when Japan's National Police Agency notified Microsoft of phishing campaigns directed at Japanese residents. The investigation expanded to encompass the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft coordinated intelligence sharing with the US Secret Service and other international law enforcement agencies.

Underground marketplace for criminal tools

YAM Store functioned as a conventional e-commerce platform where buyers could browse offerings and compare rates. The marketplace sold compromised Microsoft and Google accounts alongside pre-built phishing instruments. In certain instances, the operation's administrators took control of expired domains previously held by educational institutions and nonprofits, reconstructing them to harvest Microsoft 365 credentials for resale. Transactions occurred via Alipay, WeChat Pay and USDT.

CoGUI provided criminals with pre-fabricated websites and messaging templates designed to impersonate legitimate entities. By mid-2026, Iron Man—a successor platform—had begun assuming CoGUI's role. Researchers uncovered more than 2,300 Iron Man templates replicating banks, retailers, medical facilities, police forces and government bodies. Within the United States, the majority of deceptive content centred on transportation and administrative fees, including traffic violations and parking citations.

Microsoft assessed with high confidence that Chinese-speaking criminal actors engineered these toolkits. Perpetrators deployed them to harvest login credentials and financial information, subsequently using the stolen data to purchase luxury merchandise or execute transactions on payment platforms.

Enforcement action

Operating under a court order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC executed the takedown. Microsoft has deactivated more than 20,000 accounts linked to YAM Store and is preventing access to more than 100,000 domains employed in phishing and fraud schemes.

YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.

Steven Masada, Microsoft

Source: The Next Web