Microsoft announced on October 14th that, in collaboration with the Health Information Sharing and Analysis Center (Health-ISAC), it had seized the foundational domains of services supporting phishing crimes—"YAM Store," "CoGUI," and "Iron Man"—based on an order from a U.S. federal district court. Japan's National Police Agency and JC3 (Japan Cybercrime Control Center) also cooperated in the investigation.
These three services provided criminals with the tools necessary for phishing scams. YAM Store was a marketplace for buying and selling illicitly obtained accounts and other data; CoGUI was a tool for creating fake websites and deceptive messages; and Iron Man offered templates for emails and web pages impersonating companies and other entities.
Since January 2026, these three services enabled the sending of over a billion malicious messages targeting more than 75,000 organizations worldwide. Over 750 million of these messages targeted Microsoft customers, with victims spanning more than 150 countries.
The investigation was triggered by information received from Japan's National Police Agency in late 2025 regarding scam messages targeting Japan. JC3 also provided domestic victim information and analysis results, while Health-ISAC and multiple security companies cooperated in the investigation.
Microsoft and Health-ISAC obtained a temporary restraining order from a U.S. federal district court in Florida, seizing the domains of the criminal infrastructure and redirecting their connections. Microsoft further explained that it disabled over 20,000 accounts related to YAM Store and blocked over 100,000 domains that were abused for scams and other malicious activities.
Made with AI
