Microsoft and Health-ISAC seize YAM Store, CoGUI and Iron Man infrastructure behind more than 1 billion phishing messages to 75,000+ organisations in 150 countries; Australia Post among SMS lure templates
On 14 October 2026 Microsoft's Digital Crimes Unit, with Health-ISAC, said a US District Court for the Southern District of Florida order let them seize and redirect domains powering YAM Store (Storm-3119), CoGUI and Iron Man (Storm-2990 phishing kits) — a Chinese-language cybercrime marketplace that sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage, plus ready-made phishing kits. Since January 2026 the three services enabled more than one billion malicious messages targeting over 75,000 organisations and consumers in more than 150 countries, including more than 750 million messages aimed at Microsoft customers, generating tens of millions of dollars for operators. Microsoft has disabled more than 20,000 accounts tied to YAM Store and is blocking more than 100,000 impersonation domains. The investigation began in late 2025 after Japan's National Police Agency flagged campaigns against Japanese victims; JC3, Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and US/international law enforcement later joined. YAM Store acted as an access broker: operators bought expired organisation domains (often non-profit and education), rebuilt sites to look live, fraudulently obtained Microsoft 365 tenants, and resold them; AI tools were also used to invent fake organisations. Iron Man (advertised on YAM Store from June 2026) overtook CoGUI with more than 2,300 lure templates across 130+ countries/areas — Microsoft and Resecurity both cite Australia Post package-delivery SMS templates among the samples, alongside ANZ rewards web lures in Microsoft's illustration set. Kits support device-code phishing, geofencing, fake CAPTCHA and live OTP capture. Primary: Microsoft DCU blog 14 Oct; wires: BleepingComputer and SecurityWeek.
- Product
- YAM Store (Storm-3119) marketplace and CoGUI / Haozi / Iron Man (Storm-2990) phishing kits abusing Microsoft 365 / Google environments
- Versions
- n/a (criminal infrastructure disrupted 14 Oct 2026; activity tracked since Jan 2026 / investigation from late 2025)
- Exploited in Australia?
- unknown
- Patch to
- Treat unexpected toll, traffic, delivery and account-verification SMS/email as phishing; prefer passkeys and phishing-resistant MFA; watch for device-code consent prompts; block newly sinkholed YAM Store / CoGUI / Iron Man infrastructure as Microsoft and partners publish indicators; healthcare orgs: Health-ISAC shared sector impact intel.
Primary: Microsoft Digital Crimes Unit — Disrupting the service economy behind transnational cybercrime operations (14 Oct 2026) · Vendor: Microsoft DCU blog (Steven Masada) · BleepingComputer — Global takedown hits network behind 1 billion phishing messages (14 Oct 2026); also SecurityWeek