Microsoft and Partners Disrupt Phishing Ecosystem Behind More Than 1 Billion Messages

Microsoft and Health-ISAC seized and redirected domains supporting the Chinese-language cybercrime services YAM Store, CoGUI and Iron Man under an order from the U.S. District Court for the Southern District of Florida. The operation involved Japanese authorities, Proofpoint and other cybersecurity partners. According to Microsoft, the ecosystem enabled more than 1 billion malicious emails and SMS messages since January 2026, targeting consumers and over 75,000 organizations across more than 150 countries, predominantly the United States and Japan. Microsoft also disabled more than 20,000 YAM Store-linked accounts and blocked over 100,000 fraud-related domains.

Microsoft tracks the Chinese-speaking kit developers and sellers as Storm-2990. Their services supplied phishing kits, compromised accounts and infrastructure, including hijacked Microsoft 365 and Azure for Education tenants. Campaigns impersonated consumer and financial brands to steal credentials and payment information, harvest one-time verification codes, and abuse device-code authentication to obtain account-access tokens. Proofpoint assessed with high confidence that CoGUI, CoAceV and CoFish_Ws share common roots and overlapping affiliates; Iron Man increasingly replaced CoGUI by mid-2026. Resecurity identified 2,360 Iron Man phishing templates impersonating organizations across 130 countries and flagged its recurring licensing-server dependency as a potential disruption point. The operation is expected to impose operational and financial costs, but a sustained reduction in phishing activity has not been established; organizations should continue monitoring brand impersonation, compromised cloud tenants and suspicious device-code authentication.