Microsoft phishing market takedown halts more than 1 billion scams

Microsoft has dismantled a trio of Chinese-language phishing operations that fed a global scam operation. YAM Store, CoGUI and Iron Man enabled criminals to push more than 1 billion malicious messages to organizations and individuals since January 2026, with about 750 million of those aimed at Microsoft customers. The scale shows how sophisticated phishing kits remain a big threat to everyday users and business teams alike.

The crackdown was carried out with Health-ISAC under a Florida federal court order. Microsoft says it disabled more than 20,000 accounts tied to YAM Store and blocked over 100,000 domains used for impersonation and fraud. The action reflects a multi‑agency effort that began after a Japanese police alert in late 2025 and expanded with help from other security firms and law enforcement partners.

So what did these services do? YAM Store operated like an online shop for criminals, letting buyers purchase fraudulent Microsoft and Google accounts and ready-made scam tools. Some storefronts even repurposed expired domain names once owned by nonprofits or schools to run new scams. Payments moved through methods popular in Asia, such as Alipay, WeChat Pay and USDT, according to Microsoft.

CoGUI supplied criminals with ready-made websites and templated messages that impersonated trusted organizations. By mid‑2026, Iron Man emerged as the more prominent offering, featuring a growing library of templates that impersonated banks, retailers, healthcare providers, police departments and government agencies. In the United States, scammers most often used impersonations tied to transportation or government matters, like traffic or parking fees.

Microsoft stresses that the fight isn’t over. “YAM Store, CoGUI and Iron Man are just part of a larger criminal network, but cutting off these components makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” said Steven Masada, head of the Digital Crimes Unit. The company also coordinated with international partners, including the U.S. Secret Service.

For readers, the takeaway is simple: phishing scams keep evolving with new tools and templates. If you manage a team’s security or just protect personal accounts, scrutinize unexpected messages and avoid login links or payment pages that arrive out of the blue, even if the sender seems familiar.