Microsoft announced legal action to disrupt three phishing platforms used by Chinese-language cybercriminals: YAM Store, CoGUI, and Iron Man. Working with Japan's National Police Agency and Health-ISAC, Microsoft secured a court order to seize and redirect domains supporting the infrastructure. The operation also disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 impersonation domains.
Iron Man operates as a phishing-kit-as-a-service, offering more than 2,300 pre-built lure pages that mimic postal services, tax offices, banks, and telecoms. CoGUI provided ready-made websites and messages for impersonating trusted brands and government agencies, with heavy use in Japan before criminals shifted to Iron Man. YAM Store acted as an initial access broker, selling fraudulent or compromised Microsoft and Google accounts to scammers.
The two sources agree on the core takedown and the platforms involved, but they differ on scale. Recorded Future News reports that since January the platforms enabled more than 750 million messages targeting Microsoft customers alone, while SecurityWeek's coverage puts the overall volume at over 1 billion messages. Both note that the campaigns generated tens of millions of dollars and targeted consumers, healthcare, finance, and other sectors across more than 150 countries.