Microsoft and Health-ISAC Disrupt Chinese-Language Phishing Marketplace

Summary

Microsoft and Health-ISAC seized and redirected domains tied to YAM Store, CoGUI and Iron Man, services Microsoft says helped send over one billion malicious messages and supplied criminals with accounts, phishing kits and infrastructure.

Key points

A US District Court for the Southern District of Florida authorized the action; Health-ISAC joined the civil lawsuit because the infrastructure was used to target healthcare organizations.
Microsoft says the services sent more than one billion malicious messages since January 2026, targeting people and over 75,000 organizations in more than 150 countries.
Microsoft disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
YAM Store sold access to compromised or fraudulently obtained Microsoft and Google environments, including accounts, licenses and storage.
Microsoft tracks YAM Store as Storm-3119 and the phishing kits as Storm-2990; it assesses with high confidence that the kits were developed by Chinese-speaking threat actors.
The kits harvest credentials through interactive phishing pages and can prompt victims for one-time verification codes.
Resecurity found Iron Man depended on regular contact with its licensing server, which could make disabling or sinkholing that host disruptive to active deployments.

Article Details

Event Type: Court-authorized seizure and redirection of domains used by YAM Store, CoGUI, and Iron Man, services within a Chinese-language cybercrime marketplace.
Impact: Microsoft and Health-ISAC disrupted infrastructure reportedly used to send more than one billion malicious messages since January 2026. Microsoft said the messages targeted consumers and more than 75,000 organizations across over 150 countries, including hospitals and healthcare organizations. Microsoft disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.