Microsoft disrupts Chinese-language phishing kits behind 1bn scam messages

Microsoft and Health-ISAC seized and redirected domains tied to three Chinese-language cybercrime services, YAM Store, CoGUI and Iron Man, under a US court order. Since January 2026 the services enabled over 1bn malicious messages targeting 75,000 organizations in 150+ countries, with 750 million hitting Microsoft customers. Microsoft disabled more than 20,000 accounts and is blocking over 100,000 impersonation domains.

• Services enabled over 1bn scam messages since January 2026
• 75,000 organizations in more than 150 countries targeted
• 750 million messages hit Microsoft customers
• Over 20,000 accounts disabled, 100,000+ domains blocked