Microsoft and Health-ISAC seized domains that powered YAM Store, CoGUI, and Iron Man, a Chinese-language phishing-kit market. A US federal court order in the Southern District of Florida backed the seizure. Microsoft says the services helped send more than one billion malicious emails and SMS messages since January 2026.
What happened
Microsoft tracks the marketplace as Storm-3119 and the kit developers as Storm-2990. YAM Store sold infrastructure built on compromised or fraudulently created Microsoft 365 and Google environments, including education and nonprofit tenants. Buyers then ran CoGUI, Haozi (also called Phoenix), and Iron Man System against brands in government, finance, and logistics.
The messages hit consumers and more than 75,000 organisations in more than 150 countries. More than 750 million of them targeted Microsoft customers. Microsoft has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. Health-ISAC joined because hospitals were a frequent target. The case started after Japan's National Police Agency flagged campaigns in late 2025.
Iron Man, advertised from June 2026, is the kit replacing CoGUI. Microsoft counts more than 2,335 templates across 139 countries. The kits are live panels: operators can watch a victim and prompt for a one-time code, not just collect a static password.
Who is affected
Any organisation whose users receive brand-impersonation mail, and any Microsoft 365 tenant that an access broker could have enrolled, hijacked, or resold. Expired organisation names and education tenants were a specific supply line.
- Microsoft 365 tenants with unexpected app registrations, silent password resets, or new education licences.
- SharePoint and OneDrive sites used as bulk file hosts by an unknown admin.
- Users targeted with local-language lures for transport, government, banking, or healthcare brands.
What to do now
Review Entra app registrations and Global Admin activity for tenants you did not provision, and reset any account that received a real-time OTP prompt from a lookalike site. Block newly registered domains impersonating your brand. Treat a seized kit as a delay, not an end: the same operators can restock templates. Confirm SPF, DKIM, and DMARC on every domain that sends mail for you.
Source: SecurityWeek, citing Microsoft. Microsoft disrupts Chinese-language phishing market behind 1 billion messages.
Also on the blog
- Ivanti Connect Secure CVE-2026-104935 exploited, patch by 16 Oct
- CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
- curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0
- Ampath breach: attacker claims 80 million records, lab disputes count
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.