- Microsoft says YAM Store, CoGUI and Iron Man enabled more than 750 million phishing messages targeting Microsoft customers since January. It won a court order to seize their domains.
- The platforms sold ready-made scam pages and aged, trusted accounts, so reputation was the product. Expired company domains could be turned into credential-stealing sites.
- Leaders should inventory their domains, set rules for letting them lapse, and own a process for reporting fake pages that use their brand.
Phishing now runs as a supply chain
This case suggests phishing is no longer a craft. It looks more like a supply chain. One service sells the fake page. Another sells the trusted account to send it from.
On Wednesday, Microsoft announced legal action against three such services: YAM Store, CoGUI and Iron Man. It worked with Japan's National Police Agency and the healthcare security group Health-ISAC. A U.S. court order let Microsoft seize and redirect domains behind the platforms, The Record reported.
Microsoft says the three platforms together enabled more than 750 million messages aimed at Microsoft customers since January. That count covers Microsoft customers only. It is not the platforms' total output.
How the three pieces fit together
Iron Man is a phishing kit sold by subscription. Its catalog runs past 2,300 ready-made fake pages. The fakes pose as mail carriers, offices that issue traffic fines, tax authorities, banks and phone companies.
Subscribers also get thousands of country-specific templates. Australia, Japan and India are named, along with dozens more. Microsoft says the kit let criminals "quickly deploy" content "tailored to specific brands, industries and countries."
CoGUI offers a similar service. It supplies ready-made websites and messages that copy trusted brands and agencies. Criminals used it heavily against people in Japan. By mid-2026, they were moving to Iron Man.
YAM Store is the third piece. Microsoft calls it an initial access broker marketplace. That is a shop that sells a way in. It sold infrastructure built on compromised or fraudulently obtained accounts at providers such as Microsoft and Google. Buyers could browse for the cheapest option.
The product being sold is trust
The most telling detail is how YAM Store organized its goods. Buyers could filter listings by account age and subscription type. They could also pick the setting, such as education or non-profit. Those traits make a message look credible.
Criminals also bought domains that real companies had let expire. They rebuilt the sites to look like legitimate platforms. Microsoft says such sites could be used to steal Microsoft 365 credentials. Those credentials could then be sold on YAM Store.
That describes what the setup allowed. The report does not document how often stolen logins were actually resold. Still, it shows how one scam's output could feed the next.
The lesson here is that reputation has become a tradable good. An account's age, domain type and history are signals that people and filters rely on. This market sold them. The risk falls on organizations whose names and lapsed domains were borrowed. It also falls on the people who received the messages.
Steven Masada, of Microsoft's Digital Crimes Unit, said these tools drive many of the toll scam texts and fake delivery emails people get daily.
What the takedown shows, and what it does not
The court order let Microsoft disable more than 20,000 accounts tied to YAM Store. Microsoft says it is still removing infrastructure on its own services. It also reports blocking more than 100,000 domains used to pose as other organizations. The security firm Resecurity helped Microsoft infiltrate the sites.
The investigation began last year, when Japanese police flagged campaigns aimed at people in Japan. Microsoft found similarities across the infrastructure of all three platforms. It said this points to close collaboration or shared development origins.
The Record lists other recent Microsoft legal actions. They include last month's case against EvilTokens and June's dismantling of servers tied to SocGholish, Amadey and StealC. Earlier moves hit RaccoonO365 and RedVDS. The report does not say how the criminal market responded to any of them.
Questions to put to your team
First, do we know every domain our company has ever owned? Ask what happens when one lapses, and who decides to let it go. Expired names were part of this supply chain.
Second, how would a customer report a fake page that uses our brand? Fast takedown requests only help if someone owns the process.
Third, what do our staff and filters treat as proof of trust? An old account or a .edu address is a weak signal when such accounts are for sale. Consider sign-in methods that cannot be typed into a fake page.
Fourth, which regions and brands do we serve? Iron Man's templates were built country by country, so lures can be localized to your customers.
A takedown removes shops, but the idea behind them is a subscription anyone can buy. Defend the trust you have earned as if someone were trying to rent it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
