Microsoft and partners disrupt three phishing services used in global campaigns
Microsoft says a court-backed operation targeted YAM Store, CoGUI and Iron Man, services linked to phishing campaigns across more than 150 countries.
Microsoft announced on October 14 that it and Health-ISAC had disrupted infrastructure for three phishing services, YAM Store, CoGUI and Iron Man. The company said the services helped criminals run campaigns reaching organizations worldwide, using tools to impersonate trusted brands and steal information.
Microsoft said the three services had collectively enabled more than one billion malicious messages since January 2026, targeting over 75,000 organizations. More than 750 million of those messages targeted Microsoft customers, according to the company.
How the phishing services worked
The services offered ready-made templates that let customers imitate trusted organizations and adapt emails, text messages and web pages for particular brands, industries and countries. CyberScoop reported that the kits were used to steal credentials and financial information. It also reported Microsoft's account that attackers abused device-code authentication to obtain tokens and enter compromised accounts.
Microsoft said the campaigns reached consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, and generated tens of millions of dollars for operators. CyberScoop reported that targets were concentrated in the United States and Japan, including healthcare, financial services, logistics and IT. Resecurity, which assisted the investigation, identified 2,360 Iron Man templates impersonating organizations across 130 countries, according to CyberScoop.
What the disruption targeted
Microsoft and Japanese authorities began investigating the interconnected network in early 2025, CyberScoop reported. Microsoft and Health-ISAC used a federal court order to seize and redirect domains powering the three services. Cloudflare, Oracle, Proofpoint and TRM Labs provided research and investigative support, according to CyberScoop.
Microsoft said it disabled more than 20,000 accounts connected to YAM Store and blocked over 100,000 domains used for impersonation and fraud. It continues to remove infrastructure hosted on its services, CyberScoop reported.
Microsoft's Steven Masada said YAM Store, CoGUI and Iron Man were only part of a larger criminal network. Disrupting them makes it harder for criminals to obtain the tools and infrastructure needed for phishing, he said.
Read in depth: Technology
Apple closes above $5 trillion for the first time as technology stocks fall
Apple ended Oct. 14 with a reported market value of $5.01 trillion, reaching a milestone it had previously passed only during trading hours.
Microsoft and MIT researchers report gains in forecasts two to six weeks ahead
A study published October 14 describes a machine-learning method that corrects bias in existing weather forecasts, with reported gains in precipitation and temperature predictions.
Sources and context
- Microsoft, partners disrupt phishing kit ecosystem behind cybercrime operationsRappler
- Microsoft and partners disrupt vast Chinese-language phishing kit ecosystemCyberScoop
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.