Microsoft seizes domains of Chinese-language phishing market behind 1 billion messages

Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) have seized and redirected domains used by three components of a Chinese-language cybercrime marketplace, the company announced on October 14, 2026. According to SecurityWeek, the action targeted YAM Store and the CoGUI and Iron Man phishing kits, and was based on an order from the US District Court for the Southern District of Florida. The services are blamed for more than one billion malicious messages sent since January 2026.

What happened

SecurityWeek reports that the three services targeted consumers and more than 75,000 organizations in over 150 countries, with more than 750 million messages aimed at Microsoft customers. The operators reportedly earned tens of millions of dollars. Health-ISAC joined the civil lawsuit because the infrastructure was frequently used to target hospitals and healthcare organizations.

As part of the operation, Microsoft said it disabled more than 20,000 accounts linked to YAM Store and is blocking over 100,000 domains used for impersonation and fraud.

The investigation began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs later joined the effort, along with US and international law enforcement, according to the report.

Technical details

Microsoft tracks YAM Store as Storm-3119 and describes it as an access broker that hijacks Microsoft 365 and Azure for Education tenants, then resells the accounts, licenses and storage to other criminal operations. Buyers could reportedly filter infrastructure by account age, subscription type and environment, such as education or nonprofit tenants. The marketplace also sold infrastructure built on compromised or fraudulently obtained environments at Microsoft and Google.

YAM Store also sold phishing kits named CoGUI, Haozi and Iron Man, which Microsoft tracks as Storm-2990 and assesses with high confidence were developed by Chinese-speaking actors. CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was being replaced by Iron Man, advertised from June 2026. Microsoft counted more than 2,335 Iron Man templates for over 139 countries; many US lures impersonated transportation and government bodies such as traffic and parking-fee authorities.

Resecurity, which bought an Iron Man license and tested it in an isolated lab, counted 2,360 templates covering 130 countries and areas, the newest added on October 1. The kits support live credential harvesting, letting operators watch victims in real time and request one-time verification codes. Resecurity found that the kit regularly contacts the vendor's licensing server, meaning that disabling the server would degrade every active deployment.

Who is affected

The campaigns hit both individuals and organizations worldwide, with SMS and message lures impersonating toll, parking, postal and government services. Microsoft's Steven Masada, general manager of the Digital Crimes Unit, said the three services are only part of a larger criminal network, indicating that similar activity may continue.

What to do

Organizations, particularly in education, nonprofit and healthcare sectors, should review Microsoft 365 and Azure tenants for unfamiliar accounts, unexpected license assignments and unusual outbound mail volumes. Phishing-resistant MFA reduces the value of kits that relay one-time codes in real time. Users should treat unsolicited messages about unpaid tolls, fines or parcel fees as suspicious and access such services only through official apps or typed-in addresses.