Microsoft disrupts three major phishing platforms used in global scams

Microsoft and partners target phishing infrastructure

Microsoft, working with Japan’s National Police Agency and the healthcare cybersecurity group Health-ISAC, has disrupted three major phishing platforms: YAM Store, CoGUI and Iron Man. According to Recorded Future News↗ (opens in a new tab), the company obtained a US court order to seize and redirect internet domains used by these platforms. The action is part of a wider effort to tackle large-scale phishing operations that target people and organisations around the world.

The scale of the operation

Since January, these platforms enabled more than 750 million phishing messages targeting Microsoft customers alone. The campaigns reached consumers, healthcare providers, banks and other businesses in over 150 countries. The operators behind these tools are believed to have made tens of millions of dollars by stealing credentials, personal information and banking data. The impact is global, with victims in many sectors and regions.

How the phishing kits worked

Iron Man is described as a phishing-kit-as-a-service. This means it offers cybercriminals ready-made templates, over 2,300 lure pages, that impersonate trusted brands such as postal services, tax agencies and banks. These templates are tailored for specific countries, making the scams more convincing. CoGUI provided similar services, focusing heavily on targets in Japan before attackers shifted to Iron Man in mid-2026. Both platforms allowed criminals to quickly deploy fake emails, texts and websites that looked like legitimate communications from well-known organisations.

YAM Store operated as an initial access broker marketplace. It sold access to compromised or fraudulently obtained accounts and infrastructure, including Microsoft and Google accounts. Cybercriminals could buy domains linked to real companies that had let their domains expire, then rebuild the sites to look genuine. These fake sites were used to steal Microsoft 365 credentials, which could then be sold on YAM Store.

The investigation and takedown

The investigation began after Japanese police flagged phishing campaigns targeting people in Japan. Microsoft and law enforcement traced the activity back to a Chinese-language cybercrime ecosystem, starting with CoGUI and expanding to YAM Store and Iron Man. Microsoft worked with cybersecurity firm Resecurity to infiltrate the sites and shared intelligence with US and international law enforcement.

With the court order, Microsoft seized and redirected the malicious domains and disabled over 20,000 accounts linked to YAM Store. The company is still removing infrastructure hosted on its services and has blocked more than 100,000 domains used for impersonation. Microsoft says these tools are behind many of the scam texts and fake delivery emails people receive daily.

Ongoing efforts and context

Microsoft has increased its use of legal action to disrupt cybercrime platforms. Last month, it took down an AI-powered phishing tool called EvilTokens, and in June dismantled hundreds of servers linked to other cybercrime-as-a-service operations. The company has also targeted other phishing platforms like RaccoonO365 and RedVDS in the past year.

What you should do

Phishing remains a major threat. Be cautious with unexpected emails or texts, especially those asking for personal or financial information. Check the sender’s address and look for signs of impersonation. Use multi-factor authentication (MFA) where possible and report suspicious messages to your IT or security team. Organisations should monitor for suspicious activity and keep staff informed about the latest phishing tactics.

Uncertainties

This story is currently based on a single report from Recorded Future News. There is no primary confirmation from Microsoft or law enforcement agencies yet. Details about the full extent of the disruption and the identities of those behind the platforms are not yet clear.