Microsoft seizes domains of 3 Chinese phishing platforms

Microsoft has disrupted three phishing platforms used by Chinese cybercriminals. The company says the platforms sent hundreds of millions of malicious messages impersonating more than 75,000 organizations around the world.

The platforms are YAM Store, CoGUI and Iron Man. Microsoft obtained a U.S. court order that let it seize and redirect domains belonging to their infrastructure. It worked with Japan's National Police Agency and Health-ISAC, a healthcare cybersecurity organization that shares threat information across the sector.

Since January, the three services together enabled more than 750 million messages aimed at Microsoft customers alone. The campaigns reached consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, and made their operators tens of millions of dollars. Most of the tools were built to steal credentials, personal information, banking data and other login details.

From Japanese police tip to a wider ecosystem

According to Steven Masada, associate general counsel for Microsoft's Digital Crimes Unit, the investigation started last year. Japanese police officials flagged messaging campaigns that were targeting people in Japan.

Investigators traced those campaigns to a Chinese-language cybercrime ecosystem. It began with CoGUI but soon grew beyond it. As Microsoft and Japanese officials linked more scam campaigns to the same infrastructure, the trail led to YAM Store.

The investigation also found similarities between the infrastructure of all three platforms. Microsoft says this points to close collaboration among their developers, or to shared development origins.

Three services, three roles

CoGUI gave criminals ready-made websites and messages that impersonated trusted brands, companies, government agencies and financial institutions. It was used heavily against people in Japan, but by the middle of 2026 its users had started moving to Iron Man.

Iron Man works as a phishing-kit-as-a-service operation. Subscribers get access to more than 2,300 pre-built lure pages that pose as postal companies, traffic fine offices, tax agencies, banks, telecoms and other trusted services. The templates are tailored to Australia, Japan, India and dozens of other countries. Microsoft says the service also let thieves "quickly deploy email, text and web content tailored to specific brands, industries and countries."

YAM Store played a different role. Microsoft describes it as an initial access broker marketplace that "sells infrastructure using compromised or fraudulently obtained environments in providers like Microsoft and Google." Criminals could browse for the cheapest fraudulent Microsoft and Google accounts to run their scams.

"The marketplace offers a variety of infrastructure based on age, subscription type, and environment types such as education (.edu) or non-profit (.org)," Microsoft explained.

Buyers could also pick up domains tied to legitimate or expired organization names. Some bought domains that real companies had let expire and rebuilt them to look like genuine platforms. These sites were then used to steal Microsoft 365 credentials, which could be resold on YAM Store.

Domains seized, accounts disabled

Under the court order, Microsoft seized and redirected the domains and disabled more than 20,000 accounts connected to YAM Store. It is still removing infrastructure hosted on its own services and is blocking more than 100,000 domains used for impersonation.

Microsoft shared information with U.S. and international law enforcement partners. It also worked with cybersecurity firm Resecurity to infiltrate the sites.

Masada said these tools drive many of the toll scam texts and fake delivery messages that people receive every day.

The action is part of a broader push. Last month, Microsoft used court authorization to take down EvilTokens, an AI-powered cybercriminal platform, and worked with U.K. police to arrest its alleged operators. In June, it dismantled hundreds of servers and domains tied to cybercrime-as-a-service infrastructure used to distribute SocGholish, Amadey and StealC malware. Over the past year it has also gone after RaccoonO365 and RedVDS.

Our Take

This case shows how phishing has become a supply chain. One service sells lure templates, another hosts ready-made sites, and a third sells access to compromised or fraudulent cloud accounts. Taking down the access broker alongside the kits suggests Microsoft wants to raise costs at several points in that chain at once, not just pull individual pages offline.

The shift from CoGUI to Iron Man earlier this year is a warning, though. Criminal customers moved quickly when it suited them, and the same could happen again. Kits such as Milk Dragon show the market is crowded. It is worth watching whether the operators rebuild under new names, and whether the cooperation with Japanese police leads to arrests. For defenders, lapsed domains bearing real company names remain a risk worth tracking.