Microsoft seizes domains supporting billion-message phishing operation

Microsoft and cybersecurity partners have disrupted a global phishing network linked to more than one billion fraudulent messages, targeting infrastructure supplied through the Chinese-language YAM Store marketplace.

The operation, announced on Wednesday, involved the seizure and redirection of internet domains supporting YAM Store and two associated phishing services, CoGUI and Iron Man. Microsoft and Health-ISAC obtained an order from the United States District Court for the Southern District of Florida authorising action against the infrastructure.

Microsoft said the three services had enabled more than one billion malicious emails and text messages since January 2026, targeting consumers and over 75,000 organisations across more than 150 countries. More than 750 million messages were directed at Microsoft customers, according to the company’s investigation.

The technology group has disabled more than 20,000 accounts associated with YAM Store and blocked over 100,000 domains used for impersonation and fraud. It said further work to remove infrastructure hosted on its platforms was continuing. The action disrupts essential services but does not establish that every operator or customer has been identified or arrested.

The investigation began with fraudulent activity affecting individuals, companies and financial institutions in Japan. Microsoft’s Digital Crimes Unit worked with Japan’s National Police Agency and the Japan Cybercrime Control Center before widening the inquiry with international security specialists and technology companies.

Those involved included Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Health-ISAC, a nonprofit organisation supporting cybersecurity collaboration in healthcare, joined Microsoft in the legal action. Hospitals and other healthcare providers were among the organisations exposed to the network’s phishing operations.

Investigators identified YAM Store as a supplier of compromised or fraudulently obtained cloud accounts, software licences and hosting resources. Its customers could purchase access associated with Microsoft and Google environments, enabling them to build fraudulent websites and distribute messages appearing to originate from trusted institutions.

Microsoft tracks the marketplace under the designation Storm-3119. It identified three phishing kits promoted through the broader network: CoGUI, Haozi and Iron Man System. The company groups their developers under Storm-2990, assessing with high confidence that they are Chinese-speaking actors. That assessment does not establish sponsorship by China’s government.

The kits allowed customers to construct convincing imitations of banks, government agencies, delivery services and other organisations. Messages could claim that a parcel was undeliverable, a payment overdue or an account required urgent verification, directing recipients towards pages designed to capture passwords, financial details or other personal information.

Iron Man became an increasingly prominent offering during 2026, following earlier sales of CoGUI and Haozi. Investigators examining the service identified more than 2,300 templates for impersonating organisations in different countries, allowing criminal customers to adapt their campaigns without developing their own websites or software.

Microsoft’s technical investigation found that YAM Store operators exploited expired domains formerly associated with legitimate organisations. By rebuilding websites and presenting abandoned identities as active entities, they could obtain cloud environments and accounts that appeared credible to recipients and automated security systems.

The operators also targeted educational and nonprofit environments, which could provide useful licences and storage facilities. Some compromised Microsoft 365 and Azure for Education environments were repackaged for resale, while SharePoint and OneDrive resources were exploited to host material supporting downstream phishing activity.

Investigators also identified apparently fabricated organisations supported by websites and documentation. Microsoft assessed that artificial intelligence may have helped create some of this material, although that possibility does not mean every fraudulent account or campaign used AI-generated content.

YAM Store operated through an automated storefront, offering different account categories and pricing options. Its infrastructure included tools for managing domains and certificates, while messaging services helped connect sellers with customers. Payments across the wider ecosystem included cryptocurrencies, making parts of the commercial operation harder to trace.

The company’s research found similarities between the phishing kits’ infrastructure and functionality, suggesting shared code, common development origins or collaboration. It did not establish that all three kits were controlled by a single operator. The investigators distinguished between infrastructure suppliers, phishing software developers and customers deploying campaigns, although their activities overlapped across several services and platforms.

Court documents identify Yang Jian, doing business as Yam Store, among the defendants in Microsoft’s civil proceedings. The case also names unidentified defendants, while the court-authorised domain action forms part of an ongoing effort to dismantle services linked to the alleged fraud.