In a major coordinated offensive against transnational cybercrime, Microsoft and the Health Information Sharing and Analysis Center have seized and redirected the online infrastructure powering three Chinese-language cybercrime stores known as YAM Store, CoGUI and Iron Man.
Acting under an order granted by the US District Court for the Southern District of Florida, investigators dismantled an illicit ecosystem that has fueled over one billion malicious messages across more than 150 countries since January. The sweeping attacks targeted consumers, banks, healthcare networks, and over 75,000 organizations globally, generating tens of millions of dollars for their operators while directing more than 750 million fraudulent messages at Microsoft customers alone.Steven Masada, general manager of Microsoft’s Digital Crimes Unit, warned that seemingly routine scam messages are frequently just the visible tip of expansive transnational syndicates. Masada noted that while YAM Store, CoGUI and Iron Man represent only a segment of a broader criminal network, severing their infrastructure severely hampers scammers' ability to acquire the compromised accounts and automated toolsets necessary to stage high-volume attacks.
What Japan ‘alerted’ Microsoft about
The international takedown originated from an inquiry in late 2025, when Japan’s National Police Agency alerted Microsoft to localized phishing surges hitting Japanese residents. The probe quickly broadened into a global coalition involving the Japan Cybercrime Control Center, security and technology firms including Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs, alongside intelligence sharing with the U.S.
Secret Service and international law enforcement bodies.According to Microsoft Threat Intelligence, the illicit operations functioned as commercial, turnkey fraud clearinghouses developed by Chinese-speaking threat actors. YAM Store mirrored an everyday e-commerce storefront, allowing prospective scammers to compare prices and buy ready-made exploitation kits alongside illicit Microsoft and Google accounts.
The syndicate frequently bought expired domains previously owned by schools and charities, reviving the sites to generate Microsoft 365 tenant accounts before accepting payment via Alipay, WeChat Pay, and Tether cryptocurrency.Meanwhile, CoGUI and its mid-year successor, Iron Man, equipped threat actors with off-the-shelf phishing sites and deceptive templates mimicking credible entities. Investigators cataloged more than 2,300 Iron Man lure variations impersonating financial institutions, healthcare providers, police departments, and state agencies, with US-focused schemes heavily skewing toward transit notices, unpaid parking citations, and traffic fines.
The end goal centered on siphoning credentials and financial card data to execute unauthorized payments and purchase luxury merchandise.Following the federal court order, Microsoft disabled over 20,000 accounts directly tied to YAM Store and instituted active blocks against more than 100,000 malicious domains used for brand impersonation and wire fraud, blunting the operational reach of the syndicate.