Microsoft and the Health Information Sharing and Analysis Center (Health-ISAC) have seized and redirected domains supporting a cybercrime marketplace linked to more than one billion malicious email and text messages since January 2026. The operation targets three connected services—YAM Store, CoGUI and Iron Man—that helped criminals obtain accounts, infrastructure and ready-made phishing tools to impersonate trusted organisations.
Microsoft announced the disruption on October 14, saying the campaigns reached more than 75,000 organisations in over 150 countries, including healthcare providers, financial institutions and other businesses. More than 750 million of the messages were directed at Microsoft customers, according to the company. The action was authorised by the US District Court for the Southern District of Florida; Microsoft says it has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The scale is significant, but the deeper story is the business model behind the messages. Instead of every scammer building a fake website or acquiring cloud accounts independently, the services sold those capabilities as a package. Microsoft’s announcement of the court-backed action describes an ecosystem that made large-scale fraud easier to launch and repeat.
How the phishing supply chain worked
The three services played different roles. Microsoft describes YAM Store as an underground marketplace for compromised or fraudulently obtained Microsoft and Google accounts, licences, domains and other infrastructure. CoGUI and Iron Man supplied ready-made websites and messages designed to look like legitimate companies, banks, delivery services, government agencies and other trusted organisations.
That division of labour matters. A criminal did not need to design a convincing imitation of a bank or build the hosting infrastructure from scratch. They could acquire access and deploy a template tailored to a brand, industry or country. Microsoft’s technical investigation into the phishing ecosystem says the Iron Man kit contained more than 2,300 templates covering organisations across more than 139 countries. Some imitated financial services, healthcare, transport, retail and government agencies.
Microsoft’s researchers also found that the operation abused compromised or fraudulently created cloud environments. In some cases, operators used domains associated with legitimate organisations that had expired, rebuilding websites to make them appear active and using the resulting credibility to obtain accounts that could later be resold. The marketplace accepted cryptocurrency payments, according to Microsoft’s technical report.
What the takedown changes—and what it does not
Taking control of domains and disabling accounts can make the affected services harder to reach, interrupt customer access and raise the cost of rebuilding the operation. It is also an attempt to disrupt suppliers rather than chase every fraudulent message individually. Microsoft said it worked with Japan’s National Police Agency, the Japan Cybercrime Control Center, Health-ISAC and private-sector partners including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs during the investigation.
However, the action should not be read as the end of phishing. Microsoft’s own statement says YAM Store, CoGUI and Iron Man are only part of a larger criminal network. Other operators can reuse techniques, move to replacement infrastructure or adopt different phishing kits. A seized domain is one disruption point, not a guarantee that every message associated with the campaign has disappeared.
Microsoft assesses with high confidence that the kits were developed by Chinese-speaking threat actors. That is an assessment about the operators’ language and ecosystem; the company has not said this operation was directed by the Chinese government. Separately, SecurityWeek’s independent report on the disruption confirms the court-backed domain seizure and the scale of the services described by Microsoft.
Why the story matters for India
India is not outside the scope of the threat. Microsoft’s technical report says it observed activity linked to this phishing ecosystem targeting organisations in India, as well as in Japan, the United States and Australia. The affected sectors included financial services, healthcare, wholesale distribution and information technology. The report also lists India among the countries covered by the Iron Man kit’s impersonation templates.
For Indian businesses, the risk is not limited to a convincing fake login page. Stolen cloud identities can give attackers a foothold inside an organisation’s email, files or collaboration environment, where compromised accounts may be used to target colleagues, suppliers or customers. Organisations should review access to cloud accounts, use phishing-resistant authentication where possible, limit administrator privileges, and make sure suspicious sign-ins and message reports are investigated promptly. Microsoft’s technical guidance recommends passkeys or other strong multi-factor authentication, least-privilege access and checking the identity of the application before approving a sign-in.
For individuals, the safest response to an urgent message about a parcel, toll, tax bill or bank account is to avoid the link in the message. Open the official app or type the organisation’s known website address yourself, then check whether an action is actually required. Never disclose a one-time password or approve an unexpected sign-in simply because a page looks familiar. Scammers often use urgency and familiar branding to push people into acting before they verify the sender.
What to do if a message looks suspicious
- Verify independently: contact the organisation using a number or website you already trust, not the contact details in the message.
- Protect sign-ins: use passkeys or multi-factor authentication, and never approve an unexpected login prompt.
- Report the attempt: in India, suspicious phone numbers, email IDs, SMS senders and website URLs can be reported through the government’s National Cyber Crime Reporting Portal’s Report Suspect facility.
- Act quickly after financial fraud: contact your bank immediately and report the incident through cybercrime.gov.in or the national cybercrime helpline at 1930.
The operation exposes a central weakness in modern online fraud: the scam message is only the last step in a supply chain that can include stolen accounts, hosting, domains and ready-made impersonation tools. Disrupting that supply chain can reduce criminals’ reach, but the billion-message figure is also a reminder that prevention still depends on strong account security, cross-company intelligence sharing and people having a safe way to verify suspicious requests.
