Microsoft and Health-ISAC move against three-part cybercrime marketplace
Microsoft and the non-profit Health-ISAC have moved to dismantle three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man. According to Microsoft, the services enabled more than one billion malicious messages since January 2026.
- Microsoft and Health-ISAC are dismantling YAM Store, CoGUI and Iron Man, parts of a Chinese-language cybercrime marketplace.
- According to Microsoft, the services enabled over one billion malicious messages targeting more than 75,000 organizations since January 2026.
- Investigators identified more than 2,300 Iron Man templates impersonating organizations in over 150 countries.
- A Florida federal court order allowed domain seizures; Microsoft disabled over 20,000 YAM Store accounts and is blocking more than 100,000 domains.
- The probe began after Japan's National Police Agency alerted Microsoft in late 2025.
From Japanese scam wave to global marketplace
The investigation began in late 2025, when Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan. Investigators expected to find individual campaigns. Instead, according to Microsoft, they found a sprawling Chinese-language cybercrime marketplace where criminals could buy accounts, hosting services and tools used to build fake websites and online identities.
The effort grew to include the Japan Cybercrime Control Center (JC3), Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs. Microsoft says the ecosystem was difficult for investigators who do not speak the language to penetrate. It also says AI tools helped connect accounts, websites and infrastructure that first appeared unrelated.
Microsoft states that since January 2026 the three services collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages aimed at Microsoft customers. The targets included consumers, healthcare organizations and financial institutions in more than 150 countries, and the operation generated tens of millions of dollars for its operators, according to Microsoft.
How YAM Store, CoGUI and Iron Man worked
YAM Store operated like an online shop. Customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts and other ready-made tools, including those for credential theft. Controlled purchases by Microsoft helped confirm how it worked. In some cases, operators acquired internet domains that legitimate organizations had let expire, sometimes targeting sectors such as non-profits and education. They rebuilt the websites to make those organizations look active, which let them fraudulently obtain Microsoft 365 accounts to sell later.
CoGUI supplied ready-made websites and messages impersonating companies, financial institutions, government agencies and other trusted organizations. Criminals did not have to build fraudulent sites themselves and could quickly deploy pages designed to steal passwords, payment information and other personal data. Microsoft says CoGUI became one of the most widely used offerings, particularly against victims in Japan and the United States.
Iron Man was increasingly replacing CoGUI by mid-2026. It gave criminals access to thousands of templates for email, text and web content tailored to specific brands, industries and countries. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, government agencies and other organizations across more than 150 countries. Microsoft stresses that the appearance of an organization in these templates does not mean its systems were compromised.
Legal action and takedowns
Under an order from the United States District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains that formed part of the infrastructure behind YAM Store, CoGUI and Iron Man.
Microsoft says it has already disabled more than 20,000 accounts connected to YAM Store. It continues to dismantle the operation by removing infrastructure hosted on its services and by blocking more than 100,000 domains used for impersonation and fraud. The company also shared intelligence with the U.S. Secret Service and international law enforcement partners.
Health-ISAC contributed insight into the impact on healthcare organizations, JC3 helped establish the scale of activity affecting Japanese organizations, and the NPA supplied intelligence and investigative support throughout.
What it means
Microsoft describes the three services as only part of a larger criminal network. Its argument is that disrupting the suppliers makes it harder for criminals to obtain the accounts, tools and infrastructure they depend on, rather than only chasing individual scam messages. The company links the case to a trend in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that help criminals reach more victims.
Microsoft says the case also showed the value of two-way information sharing across industries and borders. A separate blog from Microsoft Threat Intelligence offers more detail on the network and steps customers can take to protect themselves.
