Microsoft seizes three phishing platforms behind 750 million fraudulent messages

Microsoft announced legal action on Wednesday that disrupted three phishing platforms responsible for sending hundreds of millions of fraudulent messages impersonating organizations around the globe. The operation, which targeted infrastructure tied to a Chinese-language cybercrime network, involved a U.S. court order allowing Microsoft to seize and redirect domains underlying platforms known as YAM Store, CoGUI and Iron Man.

The scale is striking even by cybercrime standards. Since January, the three platforms collectively sent more than 750 million phishing messages aimed at Microsoft customers alone, according to the company. Those messages impersonated over 75,000 organizations and hit consumers, healthcare providers, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for the people running the schemes.

Microsoft worked with Japan's National Police Agency and the healthcare-focused cybersecurity group Health-ISAC to secure the court order, and partnered with cybersecurity firm Resecurity to infiltrate the sites. Steven Masada, associate general counsel for Microsoft's Digital Crimes Unit, said the investigation traces back to last year, when Japanese police flagged suspicious messaging campaigns targeting people in Japan. Those campaigns led investigators to CoGUI, and from there to a broader web of connected infrastructure.

How the three platforms worked together

Each platform played a distinct role in the fraud pipeline. Iron Man operated as a phishing-kit-as-a-service business, offering criminals more than 2,300 pre-built lure pages designed to look like trusted institutions: postal services, tax agencies, banks, telecom providers and traffic fine offices among them. Customers paid for a subscription that unlocked thousands of templates customized for specific countries, including Australia, Japan and India. Microsoft said the kit let buyers "quickly deploy email, text and web content tailored to specific brands, industries and countries."

CoGUI served a similar purpose, supplying ready-made fake websites and messages built to mimic trusted brands, companies, government agencies and financial institutions. It was initially used heavily against targets in Japan, but Microsoft found that criminals began migrating toward Iron Man by the middle of 2026.

YAM Store filled a different niche entirely. Described by Microsoft researchers as an initial access broker marketplace, it sold infrastructure built on compromised or fraudulently obtained cloud environments from providers including Microsoft and Google. In practice, that meant cybercriminals could shop for the cheapest available fraudulent Microsoft and Google accounts to power their scams, with listings organized by account age, subscription type and environment category, including education (.edu) and non-profit (.org) domains tied to real or expired organizations.

That last detail points to a particularly effective tactic: criminals would buy up internet domains that legitimate companies had let lapse, then rebuild the sites to look like the original, trustworthy organization. Those recreated sites were then used to harvest Microsoft 365 login credentials, which could be sold for profit on YAM Store itself, closing the loop between the credential-theft tools and the marketplace for the stolen data.

Microsoft's investigation found technical similarities across the infrastructure of all three platforms, suggesting their developers either collaborated closely or shared common origins.

What the takedown accomplished

With the court order in hand, Microsoft seized and redirected the domains tied to the three platforms and disabled more than 20,000 accounts connected to YAM Store. The company said it is continuing to strip out related infrastructure hosted on its own services and is blocking more than 100,000 domains used for impersonation across the broader campaign.

Masada noted that these kinds of tools sit behind much of the everyday phishing traffic people encounter, including the toll-payment scam texts and fake delivery notification emails that have become a near-constant irritant for smartphone users.

This marks the latest in a string of legal actions Microsoft has taken against phishing infrastructure in recent months. Last month, the company moved against an AI-powered cybercriminal platform called EvilTokens, using a court order to take it offline while working with U.K. police on arrests of people allegedly tied to the operation. In June, Microsoft dismantled hundreds of servers and domains connected to cybercrime-as-a-service infrastructure used to distribute SocGholish, Amadey and StealC malware. The company has also previously gone after phishing platforms RaccoonO365 and RedVDS.

The pattern suggests Microsoft is increasingly treating legal takedowns, backed by court orders and law enforcement partnerships, as a standard tool for disrupting the commercial phishing-kit economy rather than relying solely on technical defenses. Whether that approach keeps pace with how quickly these criminal marketplaces rebuild and rebrand, as CoGUI's customers already migrated to Iron Man, remains the open question.