Microsoft and Health-ISAC have seized and redirected domains supporting three Chinese-language cybercrime services that collectively enabled more than 1 billion malicious messages since January, targeting over 75,000 organizations in more than 150 countries. The court-authorized action also disabled more than 20,000 accounts linked to YAM Store and blocks over 100,000 domains used for impersonation and fraud, Microsoft said in its announcement.
The operation, backed by an order from the U.S. District Court for the Southern District of Florida, targeted YAM Store, CoGUI and Iron Man. Microsoft described YAM Store as an online marketplace selling fraudulent Microsoft and Google accounts and other tools for credential theft. CoGUI supplied ready-made phishing pages and messages impersonating companies, banks and government agencies, while Iron Man offered more than 2,300 templates for mimicking trusted organizations across more than 150 countries.
More than 750 million of the messages were aimed at Microsoft customers, according to the company. The campaigns used familiar pressure tactics, including undelivered-package notices, unpaid toll demands, bank-account warnings and overdue tax claims, to trick recipients into disclosing passwords, payment information or other personal data. Targeted sectors included healthcare, finance, retail, transportation, telecommunications, government, education and nonprofits.
The investigation began after Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan. Health-ISAC contributed intelligence on attacks affecting healthcare organizations, while Resecurity helped investigators access the Iron Man service and identify its templates. Microsoft said the broader ecosystem generated tens of millions of dollars for its operators, but the company did not publicly attribute the activity to a named individual or government-backed threat actor.
The takedown is an infrastructure and account-disruption operation rather than a software-vulnerability response. Microsoft’s announcement identifies no CVE, CVSS score, public proof-of-concept or exploitation-in-the-wild claim associated with the campaign. The company instead describes abuse of stolen or fraudulently obtained accounts, lookalike websites, disposable domains and phishing infrastructure. It also warned that an organization appearing in an Iron Man template does not by itself show that the organization’s systems were compromised.
Organizations should treat the disruption as a reduction in criminal capacity, not the end of the threat. Security teams should continue filtering lookalike domains, scrutinizing urgent payment and login requests, monitoring newly registered or repurposed domains, and investigating suspicious account creation or credential use. Microsoft said it is removing related infrastructure hosted on its services and continuing to block domains associated with impersonation and fraud.
