Microsoft, Health-ISAC Seize Domains Behind Chinese Phishing Kits
Joint action disrupts services that sent over one billion scam messages to organizations in more than 150 countries since early 2026.
Key points
- Microsoft and Health-ISAC redirected domains for YAM Store, CoGUI, and Iron Man under a US court order.
- The services enabled over 1 billion malicious messages targeting 75,000 organizations worldwide since January 2026.
- More than 750 million of those messages targeted Microsoft customers across healthcare, banking, and retail sectors.
Microsoft and the Health Information Sharing and Analysis Center seized and redirected the domains controlling three Chinese-language cybercrime services on Wednesday. The action disrupted YAM Store, CoGUI, and Iron Man, which had operated since January 2026 to facilitate a massive global scam campaign.
The three services generated tens of millions of dollars for their operators by enabling more than one billion malicious messages. These scams targeted over 75,000 organizations in more than 150 countries. Microsoft reported that its own customers received more than 750 million of these fraudulent communications.
Operational Structure and Tools
YAM Store functioned similarly to an online marketplace, allowing criminals to browse and purchase fraudulent accounts and scam tools. According to Microsoft Threat Intelligence, the platform accepted payments via Alipay, WeChat Pay, and the cryptocurrency USDT. Operators sometimes acquired expired domains from nonprofits and schools to rebuild them for selling Microsoft 365 accounts.
CoGUI provided ready-made websites and messages designed to impersonate trusted organizations. By mid-2026, a newer offering called Iron Man began replacing CoGUI. Investigators identified more than 2,300 Iron Man templates that mimicked banks, retailers, healthcare providers, police departments, and government agencies.
Scope and Investigation Origins
Microsoft assesses with high confidence that Chinese-speaking threat actors developed these kits to steal passwords and payment data. The goal was to use stolen credentials to purchase high-end goods or conduct transactions on financial platforms. Most US-based lures involved transport or government matters, such as traffic and parking fees.
The investigation started in late 2025 after Japan’s National Police Agency alerted Microsoft to scams targeting people in Japan. It expanded to include the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. Microsoft also shared intelligence with the US Secret Service and international law enforcement partners.
What should you do?
Organizations should review email logs for unexpected spikes in volume or unusual sender domains that mimic legitimate services. Security teams should verify the legitimacy of websites requesting sensitive information, especially those related to government fees or account recovery. Users should monitor bank statements for unauthorized transactions that might indicate compromised credentials.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Microsoft
- Monitor email traffic for sudden increases in volume or messages from domains that slightly resemble official services.
- Verify the authenticity of any website asking for login credentials or payment details before entering sensitive information.
- Check financial accounts regularly for unauthorized purchases or transfers that could signal stolen data usage.
- Ensure that domain registrations for organizational assets are renewed promptly to prevent misuse by bad actors.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many malicious messages were sent using these phishing kits?
The services enabled more than one billion malicious messages targeting organizations worldwide since January 2026.
Which organizations were involved in the investigation?
The investigation included Microsoft, Health-ISAC, Japan’s National Police Agency, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.
What payment methods did YAM Store accept?
Microsoft Threat Intelligence reported that YAM Store accepted payments through Alipay, WeChat Pay, and USDT.
