Microsoft disables 20,000 accounts linked to YAM Store phishing infrastructure

Microsoft and Health-ISAC have seized and redirected domains supporting three components of a cybercrime marketplace: YAM Store, CoGUI and Iron Man. This infrastructure enabled more than 1 billion malicious messages targeting over 75,000 organisations worldwide since January 2026, according to Microsoft. The campaigns targeted consumers, healthcare organisations, financial institutions and other businesses across more than 150 countries.

Root cause

The operation relied on a Chinese-language cybercrime marketplace that supplied fraudulent accounts, hosting services and impersonation tools to criminals. Microsoft’s investigation, supported by partners including Cloudflare and Oracle, traced scam campaigns back to this ecosystem. The marketplace allowed operators to steal credentials and impersonate legitimate organisations without building their own infrastructure.

Attack path

Criminals used CoGUI to deploy ready-made websites and messages impersonating trusted entities. Instead of creating fraudulent pages manually, operators quickly deployed templates designed to steal passwords and payment information. Microsoft identified more than 2,300 Iron Man templates impersonating banks, healthcare providers and government agencies across more than 150 countries.

Affected versions

This activity targeted Microsoft customers specifically, with more than 750 million malicious messages directed at them. The investigation identified infrastructure components including YAM Store, CoGUI and Iron Man, which collectively supported the distribution of these malicious messages globally.

Mitigation

Microsoft has disabled more than 20,000 accounts connected to YAM Store. The company continues to remove infrastructure hosted on its services and block more than 100,000 domains used for impersonation and fraud. A U.S. District Court order facilitated the seizure of domains powering these three services.

Signals worth monitoring

Teams usually detect this activity by reviewing inbound email logs for spikes in messages from newly registered domains. Check whether users report receiving urgent requests for credentials or payment details from familiar brands. Monitor DNS queries for connections to known phishing infrastructure. Investigate any sudden changes in email forwarding rules or shared inbox permissions. Verify the legitimacy of unexpected login prompts by checking the URL directly.

Background: Phishing infrastructure

Secure your domain with DMARC, SPF and DKIM to prevent spoofing. Monitor for fast flux DNS patterns and analyse certificate transparency logs. Isolate endpoints to stop living-off-the-land attacks from spreading laterally.

Read the full guide: Phishing Infrastructure Prevention Checklist for Network Defenders

What to do and how to stay safe: Microsoft

• Review email logs for unusual volumes of messages from unfamiliar domains.
• Verify the authenticity of urgent requests for credentials or financial data.
• Monitor DNS traffic for connections to known phishing infrastructure.
• Check for unexpected changes in email forwarding or shared inbox settings.

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which organisations were targeted by this phishing infrastructure?

The infrastructure targeted consumers, healthcare organisations, financial institutions and other businesses in more than 150 countries.

How many malicious messages were sent using this infrastructure?

More than 1 billion malicious messages were sent targeting over 75,000 organisations since January 2026.

What actions did Microsoft take against the infrastructure?

Microsoft disabled more than 20,000 accounts and blocked more than 100,000 domains used for impersonation and fraud.