Microsoft and Health-ISAC disrupt three cybercrime services

A federal court order enabled Microsoft and Health-ISAC to seize and redirect domains supporting three Chinese-language cybercrime services, according to Microsoft. The operation targeted YAM Store, CoGUI and Iron Man, which the company linked to campaigns reaching over 75,000 organizations worldwide since January 2026.

Microsoft attributed more than 1bn malicious messages to the services, including more than 750 million directed at its customers. The campaigns reached more than 150 countries, targeting banks, healthcare groups, consumers and other businesses. The company said the operators generated tens of millions of dollars.

According to Microsoft, YAM Store offered fraudulent accounts for Microsoft and Google services, along with ready-made tools for scams. Some operators bought domains after schools and nonprofits allowed them to expire, then reconstructed the websites to obtain Microsoft 365 accounts for resale.

CoGUI provided impersonation websites and messages, while Iron Man increasingly replaced it by mid-2026. Investigators counted more than 2,300 templates for Iron Man that imitated institutions including retailers, banks, healthcare providers and police departments. Microsoft said criminals used the kits to obtain passwords and payment information.

The inquiry followed a late-2025 alert from Japan’s National Police Agency about scams aimed at people in Japan. Microsoft said it subsequently shared intelligence with international law enforcement partners and the US Secret Service.

The domain seizures were authorized by the US District Court for the Southern District of Florida. Separately, Microsoft said its enforcement measures included disabling more than 20,000 accounts tied to YAM Store and blocking more than 100,000 impersonation and fraud domains.