Microsoft disrupts major cybercrime network via domain seizures

Microsoft, in collaboration with Japan’s National Police Agency and the Health Information Sharing and Analysis Center (Health-ISAC), has successfully seized and redirected internet domains linked to a Chinese-language cybercrime marketplace. A U.S. court order facilitated the disruption of three major infrastructure components: YAM Store, CoGUI, and Iron Man.

Since January 2026, these platforms have enabled more than one billion malicious messages targeting over 75,000 organizations across more than 150 countries. Specifically, over 750 million of these messages targeted Microsoft customers. The operations were designed to facilitate fraud, steal credentials, and harvest banking and personal data.

YAM Store operated as an online shop for fraudulent Microsoft and Google accounts and credential theft tools. CoGUI provided ready-made websites and messages to impersonate legitimate businesses and government agencies. Iron Man functioned as a “phishing-kit-as-a-service,” offering over 2,300 pre-built lure pages that impersonated postal services, tax agencies, and banks, with templates tailored for countries including Australia, Japan, and India.