Microsoft and partners dismantle Chinese‑language phishing kit ecosystem that sent over 1 billion scam messages

Microsoft, in partnership with Japan’s National Police Agency and the Health‑Information Sharing and Analysis Center (Health‑ISAC), announced that it had disrupted an extensive Chinese‑language phishing kit ecosystem that had sent more than 1 billion malicious emails and text messages since the beginning of 2026. The operation targeted over 75,000 organisations across more than 150 countries, and about 750 million of those messages were aimed specifically at Microsoft customers.

The seized infrastructure included more than 20,000 accounts tied to YAM Store, and Microsoft is blocking more than 100,000 domains that were used for impersonation and fraud. The action was carried out under a court order from the U.S. District Court for the Southern District of Florida. In addition to removing the domains, Microsoft also disabled the accounts that were linked to the phishing kit services and continues to dismantle the underlying infrastructure hosted on its and other cloud services.

The investigation began in late 2025 after Japanese police reported scam campaigns targeting residents of Japan. Microsoft, Health‑ISAC and cybersecurity partners such as Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs worked together to trace the campaigns to a Chinese‑language cybercrime ecosystem.

YAM Store functions as an access‑broker marketplace that sells compromised or fraudulently obtained Microsoft and Google environments. Buyers can choose accounts based on age, subscription type and whether they are education (.edu) or non‑profit (.org) tenants, allowing cybercriminals to purchase the cheapest stolen credentials for use in downstream phishing operations.

The phishing kits themselves—CoGUI, Iron Man and the Storm‑2990/Storm‑3119 campaign—were sold on YAM Store. Iron Man offers more than 2,300 pre‑built lure pages that impersonate services such as postal companies, traffic authorities and banks; Resecurity counted 2,360 templates covering 130 countries. The kits function as live, interactive platforms that harvest credentials and, in some cases, one‑time verification codes. By mid‑2026, operators had shifted from CoGUI to Iron Man, which had begun advertising in June 2026.

The attacks targeted consumers, healthcare organisations, financial institutions and other businesses, using the phishing kits to steal credentials, banking data and personal information. The scams often mimicked urgent alerts such as undelivered packages, unpaid tolls, bank account notices or overdue tax bills, luring victims into clicking links or providing sensitive details. The operators reportedly earned tens of millions of dollars from the stolen data and fraudulent transactions.

Microsoft’s legal actions against phishing platforms extend beyond this case. Earlier in 2026 the company dismantled the AI‑powered EvilTokens platform and other phishing‑as‑a‑service sites such as RaccoonO365 and RedVDS, removing hundreds of servers and domains that were linked to cyber‑crime gangs. The company’s ongoing efforts aim to reduce the infrastructure that enables credential‑stealing operations worldwide.