Microsoft and Health-ISAC, a health-sector security group, said they are moving against three criminal services: YAM Store, CoGUI and Iron Man. Microsoft said the services enabled over one billion malicious messages since January 2026. It said the messages targeted over 75,000 organisations in more than 150 countries. A US federal court in southern Florida let the two groups seize and redirect domains. Microsoft said it disabled over 20,000 YAM Store accounts and blocked over 100,000 domains.
Microsoft said the probe began in late 2025, when Japan's National Police Agency flagged scam campaigns. It said the three services are only part of a larger network. BleepingComputer reported that more infrastructure is still being removed. The sources name no operators and mention no arrests. Microsoft said brands in the templates were not hacked.
Microsoft's account shows fraud sold in separate layers. YAM Store operators bought domains that real groups let expire. They rebuilt the sites to look active, then used them to get Microsoft 365 accounts. Iron Man sold over 2,300 ready-made fake-brand templates. BleepingComputer reported that many messages used device-code phishing, which aims to win sign-in tokens. A defender who watches only the message misses these layers. Teams can ask who owns their lapsed domains, how fast fake brand sites come down, and whether staff know this trick.