Microsoft and Health-ISAC have seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.
The action was based on an order from the US District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit after threat actors frequently leveraged the cybercrime infrastructure to target hospitals and healthcare organizations.
According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026. The messages targeted consumers and over 75,000 organizations in more than 150 countries, and over 750 million of them were aimed at Microsoft customers. The operators made tens of millions of dollars.
The company has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in the country. Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs later joined the effort, along with US and international law enforcement.
“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world. YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” wrote Steven Masada, general manager of Microsoft’s Digital Crimes Unit.
YAM Store, CoGUI and Iron Man
Microsoft tracks YAM Store as Storm-3119. The marketplace sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google. Buyers could choose based on age, subscription type and environment type, such as education or nonprofit.
“YAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations, including the phishing kits tracked as Storm-2990,” Microsoft’s threat intelligence team explained.
The Storm-2990 phishing kits were sold on YAM Store, and they are called CoGUI, Haozi and Iron Man.
Microsoft assesses with high confidence that the kits were developed by Chinese-speaking threat actors. “The similarity in their infrastructure and overlap in activity suggest either shared development origins, code reuse, or close collaboration among their developers,” Microsoft said.
CoGUI was heavily used against victims in Japan and the US, but by mid-2026 it was increasingly being replaced by Iron Man, which YAM Store started advertising in June 2026.
Iron Man offers more than 2,335 templates tailored to over 139 countries, according to Microsoft. The US accounts for the largest number of templates, and most US lures impersonate transportation and government entities, such as authorities handling traffic and parking fees.
Beyond static lures, the kits function as live, interactive platforms for credential harvesting. This setup allows operators to monitor victims in real time and prompt them for one-time verification codes.
Resecurity, which bought an Iron Man license and ran the kit in an isolated lab, counted 2,360 templates covering 130 countries and areas. The newest was added on October 1.
The company found that the kit needs regular contact with the vendor’s licensing server to function. “This confirms the panel cannot operate without regular contact with vendor infrastructure — a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation,” Resecurity said.
Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Related: NightmareStresser DDoS Service Disrupted in International Operation
