Microsoft Takes Down Massive Chinese Phishing Marketplace

A network of major Chinese-language phishing sites used by cybercriminals to impersonate tens of thousands of global corporations had their infrastructure seized following a U.S. court order sought by Microsoft and healthcare organization Health-ISAC.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

A U.S. federal judge gave the go-ahead to disrupt three phishing platforms used by Chinese cybercriminals responsible for sending more than a billion malicious emails and texts. The court order, granted in the U.S. District for the Southern District of Florida, disrupted control of half a dozen top level domains supporting the YAM Store, CoGUI and Iron Man platforms. The order also directed infrastructure providers to disable computers and servers associated with the phishing services.

The interconnected network of phishing kit operators, developers and a marketplace selling tools and infrastructure for large-scale campaigns helped threat actors target healthcare, financial services, wholesale distribution and information technology sectors in Japan, the United States, Australia and India, generating tens of millions of dollars.

It took international collaboration with the Japanese National Police Agency, Japan's Cybercrime Countermeasures Center and U.S. security firms Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs to uncover the entire phishing business.

"Working together, and with the assistance of artificial intelligence tools, we connected accounts, websites and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them," said Steven Masada, assistant general counsel at Microsoft's Digital Crimes Unit.

Police in Japan first notified Microsoft in late 2025 of malicious messaging campaigns in the country. What started as an investigation into one phishing kit opened the door to a larger ecosystem centered around a sprawling underground marketplace called YAM Store.

"The marketplace offers a variety of infrastructure based on age, subscription type and environment types such as education (.edu) or non-profit (.org)," Microsoft said in a technical report.

Customers could browse products, compare prices - around $40 to $300 - and purchase scam tools in the shop. Iron Man System contains more than 2,335 templates tailored to over 139 countries. Its lures mimic trusted brands such as traffic and parking authorities and organizations from law enforcement, healthcare, finance, transportation and retail, Microsoft said.

The kit also supports evasion techniques such as fake CAPTCHA gates to block automated browsing and geofencing that makes sure only users from targeted countries could view the phishing content.

Once victims provide their sensitive data, the kit harvests it using communication protocol WebSocket, offering phishers real-time victim interaction through Telegram notifications, Microsoft said.

Customers interested in Iron Man System can purchase a subscription with YAM Store to access the kit's license server.

One of YAM Store's operators, Yang Jian, allegedly procured and resold fraudulent Microsoft and Google cloud accounts. YAM Store operators acquire and rebuild expired websites previously owned by legitimate organizations to make them appear active again and obtain Microsoft 365 and Azure accounts to resell.

Cybercriminals "use these fraudulent accounts in connection with Chinese language phishing kits like 'CoGUI' and 'Iron Man' to steal login credentials and commit financial fraud," Microsoft and Health-ISAC said in the complaint.

"One Health-ISAC member suffered an intrusion into their protected computer systems after a member's user unknowingly clicked on a malicious link in a CoGUI phishing email. Defendants have also used YAM Store infrastructure to attack multiple Japanese and U.S. businesses," the complaint states.

YAM Store often operates a five-stage attack pipeline. For reconnaissance, the phishing supplier uses a lightweight Python web framework called Flask to covertly identify and profile cloud-enabled organizations, Microsoft said. The automation tool discovers Microsoft 365 tenants, assesses enrollment opportunities and gathers licensing and Azure cloud information.

The actor administers compromised environments from its own platform - implemented in PHP, Java/Spring and Cloudflare Workers - to maintain, monetize and expand access using stolen application credentials.

"The panel performs full directory control: it resets passwords silently (without forcing a change at sign-in), assigns education licenses and grants privileged attributes that the actor can later monetize. Because this access is application-level rather than tied to a single user session, the resulting persistence is more durable, more scalable and harder to detect," Microsoft said.

With privileged credentials, the actor moves to take over compromised tenants' SharePoint and OneDrive to store and distribute its own files. It also sells hijacked storage as a product.

YAM Store maintains a custom DNS management platform that manages phishing domains, SSL certificates and traffic routing through Cloudflare, giving customers ease of mind when they run phishing campaigns.

Bringing its capacities to market, the cybercriminal resells the hijacked accounts, licenses and storage through an automated storefront and accepts payments through popular Chinese digital payment methods Alipay and WeChat Pay and cryptocurrency tether (USDT).

In some cases, YAM Store operators also created fake organizations and sites for them to set up new Microsoft cloud environments, "likely using AI-generated content and forged documentation to make the fabricated entities appear legitimate," Microsoft said.