Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft and Health-ISAC have seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.

The action was based on an order from the US District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit after threat actors frequently leveraged the cybercrime infrastructure to target hospitals and healthcare organizations.

According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026. The messages targeted consumers and over 75,000 organizations in more than 150 countries, and over 750 million of them were aimed at Microsoft customers. The operators made tens of millions of dollars.

The company has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.

The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in the country. Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs later joined the effort, along with US and international law enforcement.

“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world. YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” wrote Steven Masada, general manager of Microsoft’s Digital Crimes Unit.

YAM Store, CoGUI and Iron Man

Microsoft tracks YAM Store as Storm-3119. The marketplace sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google. Buyers could choose based on age, subscription type and environment type, such as education or nonprofit.

“YAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations, including the phishing kits tracked as Storm-2990,” Microsoft’s threat intelligence team explained.

The Storm-2990 phishing kits were sold on YAM Store, and they are called CoGUI, Haozi and Iron Man.

Microsoft assesses with high confidence that the kits were developed by Chinese-speaking threat actors. “The similarity in their infrastructure and overlap in activity suggest either shared development origins, code reuse, or close collaboration among their developers,” Microsoft said.

CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was increasingly being replaced by Iron Man, which YAM Store started advertising in June 2026.

Iron Man offers more than 2,335 templates tailored to over 139 countries, according to Microsoft. The US accounts for the largest number of templates, and most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees.

Beyond static lures, the kits function as live, interactive platforms for credential harvesting. This setup allows operators to monitor victims in real time and prompt them for one-time verification codes.

Resecurity, which bought an Iron Man license and ran the kit in an isolated lab, counted 2,360 templates covering 130 countries and areas. The newest was added on October 1.

The company found that the kit needs regular with the vendor’s licensing server to function. “This confirms the panel cannot operate without regular with vendor infrastructure — a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation,” Resecurity said .

Related : AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft

Related : NightmareStresser DDoS Service Disrupted in International Operation

Related : 23-Year-Old Sality P2P Botnet Disrupted

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild.

US Disrupts Chinese State- Hacking Tools

Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026.

TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws

SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states.

Crypto Scammers Hijack Microsoft’s Official X Account

Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account.

Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks

The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025.

Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader

Police took control of KillSec’s leak site and secured at least 110 terabytes of data stolen from victims.

Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft

The malware framework uses a modular architecture and a custom executable file format for long-term persistence.