Microsoft says it has used a US court order to disrupt three services that supplied criminals with tools for phishing, the scam messages that trick people into handing over passwords, card details or money. The services are YAM Store, CoGUI and Iron Man, and Microsoft describes them as part of a Chinese-language cybercrime marketplace.
In a blog post published on 14 October 2026, Microsoft said the three services “have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone” since January 2026. It said the messages reached more than 150 countries and generated “tens of millions of dollars” for the people running them.
How the services worked
According to Microsoft, YAM Store worked like an online shop where criminals could buy fraudulent Microsoft and Google accounts and other ready-made scam tools. Some operators bought internet domains that real organisations had let expire, rebuilt the websites to look active, and used them to obtain Microsoft 365 accounts for resale.
CoGUI supplied ready-made fake websites and messages impersonating companies, banks and government agencies, Microsoft said. By mid-2026 it was being replaced by Iron Man, which Microsoft says offered more than 2,300 templates impersonating banks, retailers, healthcare providers, police, government agencies and parcel services.
These are the services behind many of the fake delivery, unpaid toll and tax-bill messages people receive every day, Microsoft said.
The investigation and the takedown
Microsoft said the investigation began in late 2025, after Japan’s National Police Agency alerted it to scam campaigns targeting people in Japan. Steven Masada of Microsoft’s Digital Crimes Unit told The Record that the trail led from those campaigns to CoGUI and then to YAM Store.
Microsoft acted together with Health-ISAC, a non-profit that helps healthcare organisations share threat information. With an order from the US District Court for the Southern District of Florida, they seized and redirected domains used by the three services. Microsoft says it has disabled more than 20,000 accounts linked to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
Microsoft credited help from the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, and said it shared intelligence with the US Secret Service. The sources did not report any arrests.
The Record notes this is Microsoft’s latest legal action against phishing tools, after earlier cases involving RaccoonO365, RedVDS and EvilTokens.
What this means
- Scam texts are an industry. Microsoft says criminals buy accounts, templates and hosting off the shelf.
- Disruption, not arrests. The action takes down infrastructure; no operators have been named or charged in these sources.
- Big platforms are going to court. Microsoft is increasingly using court orders to seize criminal infrastructure.
Sources
- Microsoft On the Issues, “Disrupting the service economy behind transnational cybercrime operations”, 14 October 2026. https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/
- The Record from Recorded Future News, “Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals”, 14 October 2026. https://therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms
