Microsoft and Health-ISAC Dismantle Massive Chinese-Language Phishing-as-a-Service Network

In a significant blow to the global cybercrime ecosystem, Microsoft, in collaboration with the Health Information Sharing and Analysis Center (Health-ISAC), has successfully executed a court-ordered operation to seize and redirect domains central to a sprawling Chinese-language cybercrime marketplace. The operation targeted three primary components of this illicit infrastructure—known as YAM Store, CoGUI, and Iron Man—which collectively functioned as a "one-stop shop" for criminals looking to purchase stolen accounts, sophisticated phishing kits, and the underlying infrastructure needed to conduct large-scale fraud.

The intervention was authorized by the US District Court for the Southern District of Florida. The involvement of Health-ISAC was particularly critical, as the organization stepped into the civil lawsuit after healthcare entities and hospitals worldwide were repeatedly battered by malicious campaigns launched through this specific infrastructure. By disrupting the network, the coalition has not only hindered the immediate operations of the threat actors but has also forced a significant reassessment of the tools used to target vulnerable sectors, including the healthcare industry.

The Scale of the Criminal Enterprise

According to data released by Microsoft’s Digital Crimes Unit (DCU), the impact of these services has been staggering. Since January 2026, the three platforms—YAM Store, CoGUI, and Iron Man—were leveraged to distribute more than one billion malicious messages. These messages spanned more than 150 countries, targeting over 75,000 organizations. The reach of this operation was deeply entwined with Microsoft’s own ecosystem, with over 750 million of these messages specifically designed to compromise Microsoft customers.

The operators behind this network were not merely running a hobbyist project; they were managing a lucrative, professionalized criminal enterprise that generated tens of millions of dollars in illicit revenue. In the wake of the seizure, Microsoft has disabled more than 20,000 accounts directly linked to YAM Store and has initiated a block on over 100,000 domains that were actively being used to facilitate impersonation, credential harvesting, and fraud.

The investigation, which culminated in this recent legal victory, began in late 2025. The initial spark came from Japan’s National Police Agency, which alerted Microsoft to a surge in sophisticated messaging campaigns targeting Japanese citizens. This inquiry quickly expanded into a massive international effort, drawing in cybersecurity heavyweights including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, alongside various domestic and international law enforcement agencies.

Steven Masada, general manager of Microsoft’s Digital Crimes Unit, underscored the gravity of the operation. "What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world," Masada noted. "YAM Store, CoGUI, and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools, and infrastructure they rely on."

Anatomy of a Phishing-as-a-Service Ecosystem

Microsoft tracks the YAM Store marketplace under the threat intelligence designation "Storm-3119." At its core, YAM Store operated as a sophisticated access broker. It specialized in the sale of infrastructure that had been built on top of environments compromised or fraudulently obtained from major service providers, including Microsoft and Google.

The marketplace offered a tiered, user-friendly experience for prospective criminals. Buyers could browse and select infrastructure based on specific criteria such as the age of the account, the subscription type, and the nature of the environment—with high demand for education and nonprofit tenants. "YAM Store functions as an access broker, an intermediary that hijacks Microsoft 365 and Azure for Education tenants and resells the stolen accounts, licenses, and storage as a service to downstream operations," Microsoft’s threat intelligence team explained.

One of the primary downstream operations fueled by YAM Store involved the phishing kits tracked by Microsoft as Storm-2990. These kits, known by the names CoGUI, Haozi, and Iron Man, were the engines of the operation’s success. Microsoft’s analysis suggests with high confidence that these kits were developed by Chinese-speaking threat actors. The structural similarities in the underlying infrastructure and the clear overlap in operational activity point to either a common development origin, extensive code reuse, or deep, ongoing collaboration between the various developers.

CoGUI was the primary tool for the earlier phases of the campaign, showing significant efficacy against victims in both Japan and the United States. However, by mid-2026, it began to be phased out, superseded by the more advanced Iron Man kit, which YAM Store began aggressively advertising in June 2026.

The Evolution of Phishing Kits

The Iron Man kit represents a sophisticated evolution in phishing technology. According to Microsoft’s findings, the kit provides access to more than 2,335 templates that are meticulously tailored to cover over 139 countries. The United States is the most frequently targeted region in terms of template volume, with the majority of these lures designed to impersonate official entities. These include government agencies and transportation departments, with many lures specifically designed to trick victims into paying fraudulent traffic or parking fines.

These kits are far more dangerous than simple static phishing pages. They function as live, interactive platforms designed for real-time credential harvesting. This architecture allows the remote operators to monitor their victims in real-time. If a victim lands on the fraudulent page, the operator can observe the interaction and manually trigger prompts, such as requests for one-time verification codes (OTPs), effectively bypassing standard multi-factor authentication (MFA) protections.

Resecurity, which gained access to an Iron Man license and analyzed the kit within an isolated laboratory environment, corroborated Microsoft’s findings. Their researchers identified 2,360 templates covering 130 countries and territories, noting that the developers were continuously updating the kit, with the newest template added as recently as October 1.

A critical vulnerability in the Iron Man ecosystem, however, provides a strategic advantage to defenders. Resecurity’s analysis revealed that the kit requires persistent, regular contact with a vendor-controlled licensing server to function. Without this heartbeat, the panel becomes inert. "This confirms the panel cannot operate without regular contact with vendor infrastructure—a dependency that favors defenders, since disabling or sinkholing the authorization host would degrade every active deployment, not just the one under investigation," Resecurity noted in their report.

This architectural dependency was a primary focus for the coalition of investigators. By disrupting the central control mechanisms, the authorities effectively "turned off the lights" for thousands of ongoing phishing campaigns simultaneously. The operation serves as a reminder of the increasing efficacy of cross-sector collaboration in combating the professionalized, "as-a-service" business model that now dominates the cybercrime landscape. While individual threat actors may attempt to adapt, the ability to dismantle the foundational infrastructure of these marketplaces remains one of the most potent tools in the defender’s arsenal.