Microsoft has disrupted a global cybercrime network linked to more than 1 billion malicious messages targeting consumers and over 75,000 organizations worldwide since January 2026.
In an Oct. 14 announcement, Microsoft said it worked with Health-ISAC to seize and redirect domains supporting three interconnected criminal services: YAM Store, CoGUI, and Iron Man. The services enabled criminals to impersonate trusted organizations, steal credentials, and conduct phishing campaigns across more than 150 countries.
More than 750 million messages targeted Microsoft customers alone. The takedown highlights how commercialized phishing infrastructure allows criminals to launch attacks on a massive scale, creating persistent risks for businesses even after individual campaigns are disrupted.
Microsoft seizes domains supporting global phishing operation
Microsoft and Japan's National Police Agency investigated a wave of fraudulent messaging campaigns targeting consumers and businesses in Japan, uncovering a much larger international cybercrime ecosystem.
Their investigation led to a Chinese-language marketplace where criminals could purchase compromised accounts and cloud infrastructure, as well as phishing services offering ready-made fraudulent websites and impersonation templates.
According to Microsoft Threat Intelligence, the ecosystem included several interconnected services:
- YAM Store: An underground marketplace selling access to compromised or fraudulently obtained Microsoft and Google cloud environments, including Microsoft 365 accounts, licenses, and storage used to support phishing campaigns.
- CoGUI: A phishing kit providing fraudulent websites and messages impersonating legitimate organizations.
- Iron Man: A phishing service offering thousands of templates designed to impersonate banks, retailers, government agencies, and other trusted entities.
Microsoft tracks YAM Store as Storm-3119. Separately, it tracks an activity cluster associated with CoGUI, Haozi, and Iron Man as Storm-2990. Haozi was another phishing kit marketed through YAM Store, although the Oct. 14 disruption announcement focused on YAM Store, CoGUI, and Iron Man.
The company said similarities among the three phishing kits suggest shared development origins, code reuse, or close collaboration among their developers.
Microsoft said investigators identified more than 2,300 Iron Man phishing templates impersonating banks, retailers, healthcare providers, government agencies, and other organizations across more than 150 countries.
The activity targeted healthcare, financial services, information technology, and other industries. However, an organization being impersonated by a phishing template does not necessarily mean its systems were compromised.
Acting under an order from the US District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains associated with the infrastructure supporting YAM Store, CoGUI, and Iron Man.
As of Oct. 14, Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and was continuing to remove infrastructure from its services and block more than 100,000 domains used for impersonation and fraud.
The operation targeted suppliers of phishing infrastructure rather than individual scam campaigns. Although Microsoft disrupted important components of the network, the action does not eliminate the wider phishing ecosystem.
What the phishing takedown means for enterprise security teams
The scale of the operation illustrates how phishing has evolved into a commercial service that allows attackers to purchase infrastructure rather than develop their own tools.
YAM Store provided access to Microsoft and Google environments, which could make malicious activity appear more credible. Some accounts were associated with expired organizational domains, while others involved fraudulent entities created to obtain cloud services.
These techniques complicate detection because malicious messages may originate from seemingly legitimate infrastructure. The problem extends beyond conventional email phishing. Microsoft's investigation documented attacks involving email, text messages, and credential theft, while its technical report also examined abuse of cloud authentication and infrastructure.
Previous eSecurityPlanet reporting examined how Microsoft 365 passkey phishing attacks can lead to unauthorized access to business cloud data.
Other campaigns have abused Google services to conceal phishing redirects. Separately, eSecurityPlanet reported that malicious Microsoft 365 logins can blend into legitimate activity, making compromised accounts harder to detect.
Although these are separate incidents, they demonstrate why blocking suspicious domains alone is insufficient.
Microsoft's threat intelligence report recommends strengthening identity protections, improving email security, and educating users about phishing techniques. For enterprise security teams, the findings highlight three priorities:
- Strengthen identity security: Deploy phishing-resistant multifactor authentication where supported, enforce least-privilege access, and use Conditional Access policies to protect sensitive accounts.
- Improve phishing detection: Review Microsoft Defender for Office 365 and Exchange Online Protection settings, investigate suspicious messages, and verify unexpected requests through trusted communication channels.
- Prepare for compromised accounts: Monitor unusual sign-ins and authentication changes, revoke compromised sessions, and investigate unauthorized cloud activity.
Organizations should also monitor for phishing campaigns impersonating their brands, particularly when criminals use fraudulent domains or websites to target customers.
The immediate benefit of Microsoft's action is the disruption of infrastructure supporting large-scale fraud. However, the action does not eliminate the broader phishing ecosystem, and organizations should continue to prepare for similar attacks through other criminal services.
For enterprise defenders, the broader lesson is that phishing campaigns increasingly depend on interconnected suppliers of accounts, hosting, and attack tools. Disrupting those suppliers can raise the cost of cybercrime, but organizations still need layered defenses capable of detecting malicious activity even when it uses trusted infrastructure.
More cybersecurity news: For more on Microsoft's efforts to dismantle phishing-as-a-service operations, read how the company disrupted the RaccoonO365 phishing network, which targeted Microsoft 365 credentials through a global criminal service.