Microsoft disrupts Chinese-language phishing kits behind 1bn scam messages

Microsoft and Health-ISAC have seized and redirected domains behind three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, Microsoft said on Wednesday . Since January 2026, the three services enabled more than 1bn malicious messages targeting over 75,000 organisations worldwide.

More than 750 million of those messages targeted Microsoft customers, the company said. They targeted consumers, healthcare groups, banks and other businesses in more than 150 countries. They generated tens of millions of dollars for the services’ operators.

“What appears to be a simple scam message is often the visible end of a much larger transnational cybercriminal operation.” Steven Masada, general manager of Microsoft’s Digital Crimes Unit

The investigation began in late 2025, after Japan’s National Police Agency alerted Microsoft to scam campaigns targeting people in Japan . It expanded to involve the Japan Cybercrime Control Center, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft also shared intelligence with the US Secret Service and international law enforcement partners.

YAM Store operated much like an online shop, Microsoft said. Customers could browse and compare prices. They could buy fraudulent Microsoft and Google accounts and ready-made scam tools. In some cases, its operators acquired domains that nonprofits and schools had let expire. They rebuilt the websites to get Microsoft 365 accounts to sell. The store accepted payment through Alipay, WeChat Pay and USDT, according to Microsoft Threat Intelligence .

CoGUI supplied criminals with ready-made websites and messages impersonating trusted organisations. By mid-2026, a newer offering called Iron Man was increasingly replacing it. Investigators identified more than 2,300 Iron Man templates impersonating banks, retailers, healthcare providers, police departments and government agencies. Most of its US lures concerned transport or government matters, such as traffic and parking fees, Microsoft said.

Chinese-speaking threat actors developed the kits, Microsoft assesses with high confidence. Criminals used them to steal passwords and payment data. The aim was to buy high-end goods, or make transactions on financial platforms, with the stolen data.

Microsoft and Health-ISAC acted under an order from the US District Court for the Southern District of Florida. Microsoft has disabled more than 20,000 accounts connected to YAM Store. It is also blocking more than 100,000 domains used for impersonation and fraud.

“YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.” Steven Masada, Microsoft