Microsoft, Health-ISAC seize domains behind 1B phishing messages
Microsoft's DCU and Health-ISAC seized domains for YAM Store, CoGUI and Iron Man — a Chinese-language phishing marketplace Microsoft ties to over 1 billion messages since January.
Microsoft's Digital Crimes Unit (DCU) and the healthcare threat-sharing nonprofit Health-ISAC seized and redirected domains behind three components of a Chinese-language cybercrime marketplace — YAM Store, CoGUI and Iron Man — under an order from the U.S. District Court for the Southern District of Florida. Microsoft ties the infrastructure to more than one billion malicious messages sent since January 2026. This is a disruption, not a patch: there's no fix to apply, but defenders who saw this traffic should read the indicators Microsoft's threat-intel team published.
The primary source is Microsoft's October 14 post, Disrupting the service economy behind transnational cybercrime operations, by DCU assistant general counsel Steven Masada. SecurityWeek and CyberScoop corroborate the figures.
What was disrupted
- YAM Store — an access broker that resold hijacked Microsoft 365 and Azure for Education tenants. Microsoft disabled more than 20,000 accounts connected to it.
- CoGUI and Iron Man — phishing-kit families; Microsoft says Iron Man increasingly replaced CoGUI through mid-2026.
- Microsoft also blocked more than 100,000 domains used for impersonation and fraud.
Microsoft Threat Intelligence tracks the kit cluster as Storm-2990 and the YAM Store broker as Storm-3119, per its linked analysis; the DCU post itself names the three brand components rather than the Storm clusters.
Scale, per Microsoft
- 1 billion+ malicious messages since January 2026, 750 million+ aimed at Microsoft customers.
- 75,000+ organizations targeted across 150+ countries; operators earned "tens of millions of dollars."
- Iron Man shipped 2,300+ templates impersonating banks, retailers and healthcare providers. Resecurity, which contributed research, counted 2,360 templates across 130 countries — so treat the country counts as impersonation-template reach, not confirmed victim geography.
The kits are live credential-harvesting platforms: operators watch victims in real time and prompt them for one-time codes, defeating SMS and app-based MFA. Resecurity notes Iron Man needs regular contact with a licensing server, so sinkholing that host degrades every active deployment.
Who's involved
Japan's National Police Agency alerted Microsoft in late 2025; the Japan Cybercrime Control Center, U.S. Secret Service, and Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs contributed. Health-ISAC joined the civil suit because operators targeted hospitals.
Action checklist
- Review MFA posture against real-time phishing. Code-prompt kits defeat OTP and push MFA. Prioritize phishing-resistant MFA (FIDO2/passkeys) for admins and high-value accounts.
- Hunt M365/Entra tenants for broker activity — unexpected new tenants, OAuth grants, or Azure for Education subscriptions tied to your domains. YAM Store's business was reselling hijacked tenants.
- Healthcare defenders: pull Health-ISAC's indicators and check logs against the impersonation domains Microsoft blocked.
Context
This is the same DCU playbook used against RaccoonO365 (Storm-2246, 338 domains) and the Egypt-based ONNX kit seller — seize the infrastructure under a civil order, disable the storefront. Takedowns dent supply but rarely end it: kit operators re-register and rebrand, and CoGUI's slide into Iron Man shows the marketplace iterating faster than courts move.