Science & Tech · Cybersecurity · 52 mins ago
Microsoft-led action disrupts phishing network behind more than 1 billion messages
Microsoft and its partners disrupted a cybercrime marketplace linked to more than 1 billion malicious messages since January 2026.
The operation involved YAM Store, which supplied compromised accounts and online infrastructure, and phishing kits called CoGUI, Haozi and Iron Man.
The campaigns reached more than 75,000 organizations in over 150 countries, as well as consumers; more than 750 million messages targeted Microsoft customers.
The investigation began after Japan’s National Police Agency alerted Microsoft to campaigns targeting people in Japan, and later involved law enforcement and cybersecurity companies in several countries.
A US court order allowed Microsoft and Health-ISAC to seize and redirect domains used by the services.
Microsoft also disabled more than 20,000 associated accounts and is blocking over 100,000 domains used for impersonation and fraud.
The action is intended to make phishing harder by cutting criminals off from the accounts, tools and infrastructure they relied on.
Authorities and industry partners are continuing to remove infrastructure identified through the investigation.
Microsoft, Health-ISAC and partners disrupted three services linked to a Chinese-language phishing network.
The services had enabled more than 1 billion malicious messages since January 2026, targeting over 75,000 organizations in more than 150 countries.
More than 750 million messages targeted Microsoft customers, according to Microsoft.
A federal court order allowed Microsoft and Health-ISAC to seize and redirect domains used by YAM Store, CoGUI and Iron Man.
Microsoft said it disabled more than 20,000 accounts and blocked more than 100,000 domains linked to the operation.
- Who
- Microsoft, Health-ISAC, Japanese authorities and cybersecurity partners took action against the network.
- What
- They seized and redirected domains used by YAM Store, CoGUI and Iron Man, and Microsoft disabled accounts and blocked domains.
- When
- The action was announced on October 14, 2026. A federal judge granted the domain request on October 7.
- Where
- The network targeted people and organizations in more than 150 countries. The court order came from the Southern District of Florida.
- Why
- The services supplied accounts, phishing tools and infrastructure used in campaigns to steal credentials and financial data.
This story does not have two clearly opposing sides.
Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns, prompting an investigation, according to Microsoft and SecurityWeek.
A federal judge in the Southern District of Florida granted Microsoft and Health-ISAC’s request to take control of the services’ domains.
Microsoft and its partners announced the disruption of YAM Store, CoGUI and Iron Man.
- Messages
- More than 1 billion malicious messages since January 2026
- Targets
- Over 75,000 organizations in more than 150 countries
- Microsoft customers
- More than 750 million messages targeted them
- Accounts
- Microsoft disabled more than 20,000 accounts associated with YAM Store
- Domains
- Microsoft blocked more than 100,000 domains used for impersonation and fraud
- Iron Man templates
- Resecurity counted 2,360 templates covering 130 countries and areas
4 sources
What people are saying
What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world.
Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone.
The scam message is often the only part victims see. The businesses behind it are what make it possible.
This confirms the panel cannot operate without regular contact with vendor infrastructure — a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation.