Microsoft and Health-ISAC are working to dismantle three components of a cybercrime marketplace, YAM Store, CoGUI and Iron Man, which have collectively enabled more than 1 billion malicious messages targeting more than 75,000 organizations worldwide since January 2026, according to Microsoft. The messages, including more than 750 million targeting Microsoft customers, have been used against consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for the operators. The operation targets the services and infrastructure that enable cybercriminals to conduct fraud, steal credentials and impersonate legitimate organizations.
Microsoft said its investigation, conducted with Japan’s National Police Agency and supported by the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, traced scam campaigns to a Chinese-language cybercrime marketplace supplying fraudulent accounts, hosting services and impersonation tools. With a U.S. District Court order, Microsoft and Health-ISAC seized and redirected domains supporting the three services.
Microsoft has disabled more than 20,000 accounts connected to YAM Store and continues to remove infrastructure hosted on its services and block more than 100,000 domains used for impersonation and fraud. The investigation also identified more than 2,300 Iron Man templates impersonating organizations across more than 150 countries, including banks, healthcare providers, telecommunications companies, retailers and government agencies.
“The trail led investigators deep into a Chinese-language cybercrime ecosystem that was difficult for non-native-speaking investigators to penetrate,” Steven Masada, associate general counsel and general manager at Microsoft’s Digital Crimes Unit, wrote in a company blog post. “There, they gained access to CoGUI, which supplied criminals with ready-made websites and messages impersonating companies, financial institutions, government agencies, and other trusted organizations. Instead of creating fraudulent websites themselves, criminals could quickly deploy pages designed to steal passwords, payment information, and other personal data.”
With an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that were part of the underlying infrastructure powering YAM Store, CoGUI and Iron Man. Microsoft has already disabled more than 20,000 accounts connected to YAM Store and continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.
As Microsoft’s investigation expanded, intelligence from JC3 helped confirm the scale of the activity affecting Japanese organizations and their customers. Drawing on information collected across its network of more than 130 member organizations, JC3 connected what appeared to be separate incidents to a broader pattern of scams targeting Japanese companies and financial institutions, including efforts to defraud consumers and to steal credentials and other sensitive information.
“One name that kept appearing throughout the investigation was YAM Store,” the post mentioned. “YAM Store operated much like an online shop. Customers could browse products, compare prices and purchase fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams, including credential theft. Controlled purchases conducted by Microsoft helped confirm how it worked.”
In some cases, operators acquired internet domains that legitimate organizations had allowed to expire, often targeting certain sectors, such as non-profits and education, with specialized product offerings. They then rebuilt the websites to make those organizations appear active, allowing them to fraudulently obtain Microsoft 365 accounts that could later be sold through YAM Store.
Microsoft detailed that YAM Store provided criminal infrastructure that often paired with tools and services such as CoGUI. As investigators dug deeper, they found that the marketplace was already evolving. CoGUI had become one of the most widely used offerings in the ecosystem, particularly targeting victims in Japan and the U.S., but by mid-2026 it was increasingly being replaced by a newer offering known as Iron Man.
“Iron Man expanded the model by giving criminals access to thousands of ready-made templates designed to impersonate trusted organizations. Criminals could then quickly deploy email, text and web content tailored to specific brands, industries and countries,” the post added. “Through test purchases and work with Resecurity, investigators gained access to Iron Man and identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, government agencies, and other organizations across more than 150 countries worldwide.”
It added that some were designed for government impersonation scams, using the appearance of official authority to pressure victims into making payments or disclosing sensitive personal information. Others impersonated organizations across industries, countries, and languages, from banks and airlines to telecommunications companies, retailers, and parcel delivery services.
“No single organization saw the full picture. Japan’s NPA played a critical role throughout the investigation, providing intelligence, investigative support and collaboration that helped uncover how the operation worked,” the Microsoft post observed. “JC3 helped establish the scale of the activity affecting Japanese organizations and consumers. Health-ISAC provided insight into impacts affecting healthcare organizations, while Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs contributed intelligence and investigative support.”
Working together, and with the assistance of AI tools, it added, “We connected accounts, websites, and infrastructure that initially appeared unrelated, helping expose the broader criminal marketplace behind them. Microsoft also worked closely and shared intelligence with U.S. Secret Service and international law enforcement partners.”
Microsoft observed downstream activity by hackers using infrastructure affiliated with the Storm-2990 phishing kits. In analyzed cases, the actors used common phishing techniques, such as urgency in the message and malicious links that redirect to actor-controlled infrastructure. This infrastructure allows these downstream threat actors to carry out several activities. In some cases, they steal credentials by using phishing pages that impersonate legitimate services to trick targets into providing credentials or other authentication information, which enables downstream actors to access compromised accounts.
In others, they use device code phishing, abusing the device code authentication flow to trick victims into authenticating to legitimate applications, which allows the downstream actors to obtain authentication tokens and access compromised accounts. The end goal for the downstream actors is financial fraud, using stolen payment data to make fraudulent purchases of high-end goods or fraudulent transactions on legitimate financial platforms. Hackers using the phishing kits conduct phishing campaigns at scale, whether the lure is a missing toll payment or a traffic citation.
