Microsoft, Health-ISAC Disrupt YAM Store Phishing Marketplace Behind 1 Billion Messages

Microsoft and Health-ISAC disrupted a Chinese-language cybercrime marketplace responsible for sending more than one billion phishing messages. The operation, backed by a US District Court order, seized domains powering YAM Store, CoGUI, and Iron Man. This action follows an investigation that began in late 2025 after alerts from Japan’s National Police Agency regarding malicious campaigns targeting people in the country.

The seized infrastructure supported three key components of the criminal ecosystem: YAM Store, which sold compromised accounts, and two phishing kits known as CoGUI and Iron Man. According to SecurityWeek, Health-ISAC joined the civil lawsuit because threat actors frequently used this infrastructure to target hospitals and healthcare organizations. Health-ISAC stated that operators generated tens of millions of dollars from these activities since January 2026.

Market Mechanics and Infrastructure

Microsoft tracks the underground marketplace as Storm-3119 and the phishing kit developers as Storm-2990. YAM Store functioned as an access broker, hijacking Microsoft 365 and Azure for Education tenants to resell stolen accounts and licenses. Buyers could select environments based on age, subscription type, or sector, such as education or nonprofit. This model allowed criminals to rent compromised infrastructure for large-scale attacks without owning the underlying assets.

The phishing kits sold through YAM Store included CoGUI, Haozi, and Iron Man. Evidence indicates these kits share overlapping capabilities and infrastructure, suggesting close collaboration among their Chinese-speaking developers. Microsoft said that Iron Man System was advertised starting in June 2026, following the earlier availability of CoGUI and Haozi. These tools provided templates impersonating legitimate brands across government, financial, and logistics sectors.

Scope of Impact

Since January 2026, the threat actors behind these kits facilitated the sending of over one billion phishing emails and SMS messages. These messages targeted consumers and more than 75,000 organizations in over 150 countries. More than 750 million of these messages were aimed specifically at Microsoft customers. The campaign affected sectors including healthcare, financial services, wholesale distribution, and information technology in regions such as Japan, the US, Australia, and India.

Threat Times previously reported on October 15, 2026, that Microsoft and Japan dismantled the YAM Store phishing marketplace. That earlier reporting covered a joint takedown of a cybercrime network responsible for over one billion scam messages targeting organizations across 150 countries. Microsoft has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.

What should you do?

Organizations should review their account activity for signs of unauthorized access, particularly in education and nonprofit tenants. Security teams should monitor for phishing attempts using templates impersonating major brands in finance and logistics. Administrators should verify the legitimacy of new domain registrations linked to their infrastructure. Users should remain vigilant against SMS and email messages requesting credentials or financial information.

What to do and how to stay safe: Microsoft

• Monitor user accounts for unusual login locations or frequency, especially in shared or educational environments.
• Implement strict multi-factor authentication policies to protect against credential theft from phishing kits.
• Review email gateways for messages originating from newly registered or suspicious domains.
• Train employees to recognize phishing templates impersonating government and financial institutions.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is YAM Store?

YAM Store is a Chinese-language cybercrime marketplace tracked as Storm-3119 that sells compromised Microsoft and Google environments and phishing kits.

How many messages were sent using this infrastructure?

More than one billion malicious messages were sent since January 2026, targeting organizations in over 150 countries.

Which sectors were targeted?

The campaigns targeted healthcare, financial services, wholesale distribution, and information technology sectors in Japan, the US, Australia, and India.