Microsoft disrupts YAM Store phishing market behind 1B+ messages

Microsoft and Health-ISAC seized and redirected domains tied to YAM Store, CoGUI and Iron Man, a Chinese-language cybercrime marketplace selling accounts and phishing kits, under a US District Court order in Florida. The services were used to send over 1 billion malicious messages since January 2026, targeting 75,000 organizations in more than 150 countries. Microsoft disabled 20,000+ accounts and is blocking 100,000+ domains.

• Domains of YAM Store, CoGUI and Iron Man seized under Florida court order
• Over 1 billion phishing messages sent since January 2026
• 75,000 organizations in 150+ countries targeted; 750M messages hit Microsoft customers
• 20,000+ accounts disabled, 100,000+ domains being blocked