Microsoft Seizes Domains Powering Global Cybercrime Marketplace

Executive Summary

• Microsoft and Health-ISAC, acting on a court order from the U.S. District Court for the Southern District of Florida, seized and redirected domains powering three services in a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man, according to Microsoft Source.
• Since January 2026, the three services collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages aimed at Microsoft customers, the company said.
• Microsoft has disabled more than 20,000 accounts tied to YAM Store and blocked more than 100,000 domains used for impersonation and fraud, per the same disclosure.
• The investigation, which began in late 2025 after a alert from Japan's National Police Agency, expanded to include JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, Microsoft Source stated.

Key Takeaways

• Microsoft and Health-ISAC moved against three named components of a criminal marketplace — YAM Store, CoGUI and Iron Man — rather than individual scam campaigns.
• YAM Store functioned as a shop selling fraudulent Microsoft and Google accounts and other ready-made scam tools; CoGUI supplied impersonation websites and messages; Iron Man expanded the model with more than 2,300 impersonation templates covering over 150 countries.
• The operation blended public-sector intelligence from Japan's NPA and JC3 with private-sector analysis from Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, alongside U.S. Secret Service coordination.
• Microsoft frames the case as evidence of a broader pattern in its Digital Defense Report: fraud increasingly depends on suppliers that lower the cost of reaching victims at scale.

Microsoft Source Disruption Targets and Scale of Operation

Microsoft's account describes a marketplace economy in which criminals no longer need to build their own phishing infrastructure. YAM Store operated like an online shop where customers could browse products, compare prices and buy fraudulent Microsoft and Google accounts and related credential-theft tools. Microsoft ran controlled purchases to confirm how it worked. In some cases, operators acquired internet domains that legitimate organizations had allowed to expire — often in non-profits and education — rebuilt the sites to make those organizations appear active, and used them to fraudulently obtain Microsoft 365 accounts for resale.

CoGUI was already embedded in the ecosystem before investigators arrived, supplying criminals with ready-made websites and messages impersonating companies, financial institutions, government agencies and other trusted organizations. By mid-2026, Microsoft says, CoGUI was increasingly being replaced by Iron Man, which offered thousands of ready-made templates and let criminals deploy email, text and web content tailored to specific brands, industries and countries. Test purchases and work with Resecurity gave investigators access to Iron Man, where they identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across more than 150 countries.

The reach was global but concentrated in two markets for CoGUI: victims in Japan and the United States. Microsoft states that the three services generated tens of millions of dollars for their operators. It also notes that the appearance of an organization or government entity in an Iron Man template does not indicate that the organization's systems were compromised.

Microsoft Source Investigation Timeline and Partner Roles

The case began in late 2025, when Japan's National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in Japan. The NPA continued supplying intelligence and investigative support as partners traced campaigns back to suppliers. The trail led into a Chinese-language ecosystem that Microsoft describes as difficult for non-native-speaking investigators to penetrate, with CoGUI providing the entry point.

JC3, drawing on more than 130 member organizations, helped connect what appeared to be separate incidents into a broader pattern affecting Japanese companies and financial institutions. Health-ISAC provided insight into impacts on healthcare organizations. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs contributed intelligence and investigative support. Microsoft also shared intelligence with the U.S. Secret Service and international law enforcement partners. Microsoft credits AI tools with helping connect accounts, websites and infrastructure that initially appeared unrelated.

Related: How Health Tech Streamlines Data and Care in 2026, According to SAP and GE HealthCare

The enforcement step was a court order from the U.S. District Court for the Southern District of Florida, under which Microsoft and Health-ISAC seized and redirected domains tied to the three services. Microsoft says it has already disabled more than 20,000 accounts connected to YAM Store and is continuing to remove infrastructure hosted on its services.

Microsoft Source Partner Network and Evidence Base

The breadth of the partner list is itself part of the story Microsoft tells. Japan's NPA supplied the original tip and continued investigative support. JC3, with more than 130 member organizations, established the scale of activity affecting Japanese organizations and consumers. Health-ISAC contributed healthcare-sector visibility. Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs provided intelligence and investigative input across domains, email, hosting and financial tracing.

For deeper context, see our Space analysis: "Space innovation accelerates: reusable launch, mega-constellations, D2D".

Microsoft is explicit that no single organization saw the full picture, and that two-way information sharing across industries and borders was required to map how interconnected services worked together. The company links the case to a broader finding in this year's Microsoft Digital Defense Report: modern fraud increasingly relies on businesses and services that make it easier for criminals to reach more victims. The evidence for the enforcement action rests on controlled purchases, partner intelligence, seized infrastructure and domain redirection under the Florida court order. Microsoft's disclosure does not quantify how much of the ecosystem remains operational beyond the three named services, stating only that YAM Store, CoGUI and Iron Man are part of a larger criminal network.

Microsoft Source Implementation Risks

Disruption of three named services does not remove demand for the accounts, templates and hosting that criminals buy. Microsoft's own framing acknowledges this: YAM Store, CoGUI and Iron Man are only part of a larger network, and the company notes that CoGUI was already being displaced by Iron Man by mid-2026. That substitution dynamic is the central risk for defenders — the marketplace adapted once and can adapt again. A second risk is measurement. The disclosed figures describe messages enabled and domains blocked through a specific enforcement window, not the residual population of impersonation infrastructure, so organizations should not read the action as a durable reduction in scam volume.

Additional coverage: AI Startups Shift From Model Mania to Measurable Business Outcomes

A third risk is organizational: the outcome depended on cross-border, cross-sector intelligence sharing, which is difficult to reproduce as a routine process rather than a one-off investigation. Finally, Microsoft cautions that inclusion of a brand or government entity in an Iron Man template does not mean that entity's systems were compromised, a distinction that matters for incident-response triage and for how victims assess exposure.

Editorial independence disclosure: this article is an independent newsroom analysis of the cited Microsoft Source publication and was not reviewed or approved by Microsoft. Source note: all factual claims derive from Microsoft Source's October 14 disclosure.

What This Means for Practitioners

For security, fraud and procurement teams, the operational lesson is to treat impersonation infrastructure as a supply chain problem rather than a per-campaign nuisance. The disclosed mechanics — expired-domain acquisition, especially in non-profit and education sectors, and template kits impersonating banks, retailers, delivery services and government agencies in more than 150 countries — describe inputs that defenders can monitor. Practitioners should watch for lapsed-domain re-registration tied to their own brands, expect template-driven phishing to shift rapidly in language and branding, and recognize that an appearance in a criminal template is not evidence of a breach on their side.