Microsoft and the Health-ISAC cybersecurity group have disrupted a phishing network responsible for over one billion fraudulent messages worldwide this year. On October 14, the companies announced they had secured a US court order to seize and redirect domains supporting YAM Store, CoGUI, and Iron Man—three services that sold accounts and phishing infrastructure to criminal groups.
According to Microsoft's investigation, these services enabled criminals to target more than 75,000 organizations across more than 150 countries since January, generating tens of millions of dollars for their operators. Microsoft disabled over 20,000 accounts linked to YAM Store and continues blocking more than 100,000 impersonation and fraud domains.
How the operation worked
The investigation began after Japan's National Police Agency alerted Microsoft to scams in late 2023. Researchers traced the campaigns to a Chinese-language marketplace where criminal groups purchased ready-made phishing infrastructure without building it themselves.
YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources, and hosting services. Operators revived expired domains belonging to nonprofits and educational institutions, using them to obtain Microsoft 365 accounts for resale.
CoGUI and Iron Man provided pre-built phishing pages and messages impersonating banks, retailers, transport authorities, and government agencies. Security researchers identified more than 2,300 Iron Man templates that customers could customize for specific brands and countries.
Cryptocurrency payments enabled the scheme
The three services accepted cryptocurrency as payment, including Tether's USDT and Ethereum. YAM Store's storefront supported USDT on the Tron network alongside traditional payment methods like Alipay and WeChat Pay. Other marketplace offerings could be purchased with USDC.
YAM Store also operated a sub-reseller tier that expanded account and infrastructure distribution beyond its own storefront, allowing criminals to purchase and resell compromised credentials and phishing services.
Enforcement and ongoing challenges
The disruption effort involved Japan's National Police Agency and Cybercrime Control Center alongside private partners including Cloudflare, Oracle, Proofpoint, and Resecurity. Cloudflare suspended accounts, disabled Workers projects supporting phishing pages, and banned hundreds of associated domains and projects. Where domain seizure was not possible, the company placed warning pages on malicious links.
Blockchain analytics firm TRM Labs helped investigators locate and freeze assets linked to the group, though the company did not disclose the value of frozen assets.
Microsoft identified a vulnerability in Iron Man's subscription model: customers accessed phishing software through vendor-controlled licensing servers. Disabling this infrastructure could prevent customers from using purchased kits, even if copies remained in circulation.
The agencies acknowledged that some domain registrars operate in jurisdictions where legal seizures face obstacles, requiring ongoing blocking through security warnings even as those domains remain online. Microsoft said the targeted suppliers were part of a larger criminal network with related infrastructure still being removed.
