Microsoft Seizes Domains Behind YAM Store, CoGUI and Iron Man Phishing Network That Sent 1 Billion Messages

Published October 17, 2026, 07:37 PKT. Based on Microsoft's "On the Issues" blog post of October 14, 2026, by Steven Masada, general counsel and general manager of the Digital Crimes Unit (primary source), and secondary reporting by WEEX Crypto News, WebPro News and ITechPost.

Microsoft and Health-ISAC have seized and redirected the internet domains supporting three components of a Chinese-language cybercrime marketplace, YAM Store, CoGUI and Iron Man, that supplied criminals with stolen accounts, phishing kits and hosting infrastructure, Microsoft said in an October 14, 2026 statement. The action, taken under an order from the U.S. District Court for the Southern District of Florida, strikes at a network Microsoft says enabled more than 1 billion phishing messages since January 2026, targeting over 75,000 organizations in more than 150 countries and generating tens of millions of dollars for its operators. The operators accepted payment in cryptocurrency, including USDT on the Tron network, ETH and USDC, and blockchain intelligence firm TRM Labs helped investigators locate and freeze related crypto assets.

The court order and the seizure

Microsoft's Digital Crimes Unit and Health-ISAC, a nonprofit that helps health-sector organizations share cyber threat intelligence, obtained the civil court order early this month and moved to dismantle the domains used by the three services, according to the announcement written by Steven Masada, Microsoft's general counsel and general manager of the Digital Crimes Unit. Microsoft said it has disabled more than 20,000 accounts linked to YAM Store and is continuing to block more than 100,000 domains used for impersonation and fraud. More than 750 million of the malicious messages were aimed at Microsoft customers alone, Masada wrote.

A marketplace and two phishing kits

The three services played different roles in what Microsoft described as a division of labor typical of modern cybercrime. YAM Store, which Microsoft tracks as Storm-3119, acted as an access broker: it took over Microsoft 365 and Google tenants, often at educational or nonprofit organizations, and resold accounts, cloud storage, DNS and phishing support. The phishing kits, CoGUI, Haozi and Iron Man, which Microsoft tracks together as Storm-2990, gave buyers ready-made templates to impersonate trusted organizations, letting criminals send email, text and web content tailored to specific brands, industries and countries. The Iron Man kit alone offered more than 2,300 lure templates covering over 139 countries, impersonating governments, banks, logistics companies and well-known brands, with evasion features such as geofencing, CAPTCHA gates and IP filtering, plus device-code phishing to capture authentication tokens and Telegram alerts when a victim submitted credentials, according to Microsoft's security writeup.

Paid in USDT, ETH and USDC

The marketplace took cryptocurrency alongside Alipay and WeChat Pay, according to Microsoft's partners. The network accepted payments in USDT on the Tron network, ETH and USDC, WEEX Crypto News reported, and TRM Labs assisted investigators in locating and freezing the related assets. The crypto payment rails let the operators collect tens of millions of dollars from buyers worldwide without touching the traditional banking system.

How Japan's police started the case

The investigation began after Japan's National Police Agency alerted Microsoft late last year to malicious messaging campaigns targeting consumers and businesses in Japan, the company said. The probe widened to include the Japan Cybercrime Control Center, security firm Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Health-ISAC joined as a key partner because hospitals ranked among the most frequent targets. Japan and the United States were the most heavily affected countries, with activity also seen in Australia and India. Microsoft warned that phishing messages are still arriving daily and that the takedown dents the supply of ready-made kits and trusted infrastructure rather than ending phishing itself.

This article is news reporting and is not investment advice.

Sources

• Microsoft "On the Issues" blog, October 14, 2026, by Steven Masada, general counsel and general manager of the Digital Crimes Unit, primary source for the U.S. District Court for the Southern District of Florida order, the seized and redirected domains, the 20,000 disabled YAM Store accounts, the 100,000 blocked fraud domains, the 1 billion messages since January 2026, the 75,000 organizations in 150-plus countries, the 750 million messages aimed at Microsoft customers, the tens of millions in operator revenue, and the Storm-3119/Storm-2990 designations
• WEEX Crypto News, October 16, 2026, secondary source for the cryptocurrency payment rails (USDT on Tron, ETH, USDC) and TRM Labs' role in locating and freezing related assets
• WebPro News, secondary source for the Iron Man template count, device-code phishing, the hijacked education and nonprofit tenants, and the coalition of partners
• ITechPost, October 15, 2026, secondary source for the court order detail, the Japan National Police Agency origin of the investigation, and the YAM Store expired-domain infrastructure model