Cybersecurity
Microsoft and partners seize phishing network
Microsoft said an investigation with Japan’s National Police Agency uncovered a Chinese-language phishing marketplace tied to several kits, then led to court-backed seizures, account deactivations and domain blocking.
- Microsoft said it and Japan’s National Police Agency began investigating fraudulent activity that led to the discovery of a Chinese-language cybercrime marketplace.
- The company linked YAM Store to CoGUI, Haozi and Iron Man System, and said YAM Store sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage.
- Microsoft said the phishing platforms sent more than 750 million messages to Microsoft 365 customers this year.
- Under a U.S. court order, Microsoft and Health-ISAC seized and redirected domains tied to YAM Store, CoGUI and Iron Man, and Microsoft said it disabled more than 20,000 accounts and blocked 100,000 domains.
Microsoft said it and Japan’s National Police Agency began looking into fraudulent activity and uncovered a Chinese-language cybercrime marketplace selling phishing tools and services. It linked the marketplace to YAM Store, known as Storm-3119, and to the CoGUI, Haozi and Iron Man System kits, which it tracked together as Storm-2990.
Microsoft said YAM Store had sold compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and storage. According to the company, operators used expired domains from real organisations, rebuilt sites to keep those identities looking live, and also created fake companies with AI-generated material.
Microsoft said the phishing platforms had sent more than 750 million messages to Microsoft 365 customers this year. It said many of the messages used device-code phishing to steal authentication tokens, while CoGUI had targeted the United States and Japan and Iron Man had offered more than 2,300 templates.
Under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains tied to YAM Store, CoGUI and Iron Man. Microsoft said it also disabled over 20,000 accounts and blocked 100,000 domains, and that more infrastructure was being removed with Japanese authorities, JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs.
Named in this story
Companies
- Microsoft
- initiated the investigation and reported the takedown
- Resecurity
- analysed exposed infrastructure and added findings
- Proofpoint
- earlier identified campaigns associated with CoGUI
- Cloudflare
- was listed as a partner in the continuing removal work
- Oracle
- was listed as a partner in the continuing removal work
- TRM Labs
- was listed as a partner in the continuing removal work
- had environments, accounts, licences and storage sold by the marketplace
Organisations
- Health-ISAC
- helped seize and redirect domains
- JC3
- was among the Japanese partners involved in the removal effort
Governments and agencies
- Japan’s National Police Agency (NPA)
- joined Microsoft in the initial investigation
- U.S. District Court for the Southern District of Florida
- issued the order used for domain seizure and redirection
Products and systems
- YAM Store (Storm-3119)
- the underground marketplace linked to the phishing operation
- CoGUI
- a phishing kit linked to the marketplace
- Haozi
- a phishing kit linked to the marketplace
- Iron Man System
- a phishing kit linked to the marketplace
- Storm-2990
- Microsoft’s label for the kit cluster
- Microsoft 365
- was the service targeted by many of the phishing messages
How the source tells it
The piece was mostly straight reporting, but it used Microsoft's own framing and large aggregate counts to make the operation feel urgent and unusually large.
- alarm loaded descriptors and threat-heavy totals around the network
- scale emphasis aggregate figures repeated without breakdown to stress reach
- vendor boosterism Microsoft's own report and wording carried the central allegations