Microsoft, Health-ISAC Seize Domains of Phishing Infrastructure Targeting Healthcare
Joint operation dismantles YAM Store, CoGUI and Iron Man services linked to over 1 billion malicious messages sent since January 2026.
Key points
- Microsoft and Health-ISAC seized domains supporting three cybercrime marketplace components: YAM Store, CoGUI and Iron Man.
- The infrastructure enabled more than 1 billion malicious messages targeting over 75,000 organizations since January 2026.
- Investigators disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 impersonation domains.
Microsoft and Health-ISAC have dismantled key components of a cybercrime marketplace that facilitated more than 1 billion malicious messages since January 2026, according to Microsoft. The operation targeted YAM Store, CoGUI and Iron Man, services that enabled fraudsters to steal credentials and impersonate legitimate organizations across more than 150 countries.
The joint effort resulted in the seizure and redirection of domains powering these three services, executed under a U.S. District Court order. Microsoft stated that the infrastructure generated tens of millions of dollars for operators by targeting consumers, healthcare organizations, financial institutions and other businesses. The campaign specifically impacted more than 750 million messages directed at Microsoft customers.
Investigation and Infrastructure Details
Microsoft’s Digital Crimes Unit conducted the investigation with Japan’s National Police Agency and the Japan Cybercrime Control Center. Support came from Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Investigators traced scam campaigns to a Chinese-language marketplace supplying fraudulent accounts, hosting services and impersonation tools. Steven Masada, associate general counsel at Microsoft, noted the ecosystem was difficult for non-native speakers to penetrate.
CoGUI supplied criminals with ready-made websites and messages impersonating trusted entities. Instead of building fraudulent sites, attackers deployed pages designed to steal passwords and payment information. Iron Man provided more than 2,300 templates impersonating organizations including banks, healthcare providers, telecommunications companies, retailers and government agencies.
Scope and Impact
The operation targeted the services enabling cybercriminals to conduct fraud and steal credentials. Microsoft has disabled more than 20,000 accounts connected to YAM Store. The company continues to remove infrastructure hosted on its services and block more than 100,000 domains used for impersonation and fraud.
The messages originated from a marketplace supplying tools to criminals globally. The investigation identified templates used across more than 150 countries. Healthcare organizations were among the primary targets, alongside financial institutions and other businesses. The seizure aims to disrupt the underlying infrastructure powering these fraudulent activities.
What should you do?
Security teams should monitor for unauthorized domain changes or new impersonation sites mimicking their organization. Organizations should review email logs for anomalies indicating credential theft attempts from the identified time frame. Users should verify the legitimacy of unexpected requests for payment or personal data through secondary channels.
What to do and how to stay safe: Microsoft
- Review email headers and logs for messages originating from domains associated with YAM Store, CoGUI or Iron Man.
- Verify the authenticity of any urgent requests for credentials or payment information by contacting the sender via a known, trusted channel.
- Monitor for new phishing templates impersonating your organization, especially those targeting banking or healthcare sectors.
- Ensure email filtering rules are updated to block known malicious domains and suspicious impersonation patterns.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What services were dismantled in this operation?
Microsoft and Health-ISAC dismantled YAM Store, CoGUI and Iron Man, which were components of a cybercrime marketplace.
How many malicious messages were linked to this infrastructure?
More than 1 billion malicious messages were enabled by these services since January 2026, according to Microsoft.
Which organizations were targeted by the phishing campaigns?
The campaigns targeted consumers, healthcare organizations, financial institutions, telecommunications companies, retailers and government agencies.
