Microsoft seizes phishing market behind 1B messages
Microsoft and Health-ISAC, backed by a U.S. court order, seized and redirected domains tied to YAM Store, CoGUI, and Iron Man, a Chinese-language phishing marketplace that Microsoft says has pushed more than 1 billion malicious messages since January 2026. Those campaigns reached more than 75,000 organizations in over 150 countries, with more than 750 million aimed at Microsoft customers.
The marketplace sold buyers ready-made lure pages, messages, and cloud infrastructure tuned to a country, brand, or industry. That let criminals rent convincing impersonation instead of building it themselves, and use compromised or fraudulently obtained accounts to make the messages look like routine business notices.
The exposure here is the ecosystem, not one sender: if an organization leans on Microsoft 365 or similar cloud identity and email workflows, one blocked domain or spoofed brand does not collapse the campaign. What persists is the ability to buy localized impersonation at scale, which keeps credential theft available even after this takedown.
In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally.
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing.