Microsoft and Health-ISAC Disrupt YAM Store, CoGUI and Iron Man Infrastructure
Microsoft and Health-ISAC obtained court approval to seize and redirect domains associated with the YAM Store marketplace and the CoGUI and Iron Man phishing kits.
The disruption of YAM Store, the CoGUI and Iron Man phishing kits was carried out by Microsoft and the Health-ISAC organization under a decision by the U.S. District Court for the Southern District of Florida. The court authorized a temporary measure allowing the partners to seize and redirect domains used by this infrastructure.
The lawsuit is filed under number 1:26-cv-26998-JEM. Microsoft says that since January 2026, the three affected services have enabled the distribution of more than one billion malicious messages targeting over 75,000 organizations in more than 150 countries. These metrics come from Microsoft, and no independent comprehensive audits are available for them.
Action Against YAM Store and Phishing Services
According to Microsoft, YAM Store operated as part of the phishing supply chain. It allegedly provided fraudulently obtained cloud accounts and domains. CoGUI and Iron Man were phishing kits—tools and templates for creating fake pages designed to harvest login or payment information.
Microsoft identifies CoGUI, Haozi and Iron Man as kits sold in the Chinese-speaking criminal ecosystem. The current legal action, however, concerns YAM Store, CoGUI and Iron Man. The company assesses with high confidence that the developers are Chinese-speaking actors, but the available information does not confirm their nationality or any connection to the Chinese state.
Alongside the legal action, Microsoft said it deactivated more than 20,000 accounts linked to YAM Store. It is also blocking more than 100,000 domains used to impersonate brands and conduct fraud.
What This Action Restricts
According to Microsoft, the affected infrastructure supported campaigns involving fake requests for toll, fine or package-delivery payments. Seizing the domains may temporarily disrupt attackers’ access to the technical infrastructure they need to operate fraudulent sites and distribute messages.
The case also illustrates the division of roles in the phishing-as-a-service environment: one service may supply accounts and domains, while others sell tools for creating fraudulent pages. This model allows service users to launch campaigns without developing the entire infrastructure themselves.
Operators and the Full Scope Remain Unresolved
The lawsuit names Yang Jian d/b/a Yam Store and other unknown defendants. These are allegations by the plaintiffs in an ongoing civil case, however. It has not been confirmed that all people involved in operating the services have been identified or detained.
Microsoft also warns that it is continuing to remove the remaining infrastructure. The court-ordered redirection of domains therefore does not automatically and permanently eliminate the entire ecosystem; its operators or customers may try to use new domains, brands or replacement services.
Further developments will show whether the temporary court measure becomes a preliminary or permanent injunction, whether law enforcement announces additional steps, and whether replacement channels linked to YAM Store, CoGUI or Iron Man emerge.
Sources
- Microsoft Digital Crimes Unit – Yam Store-CoGUI-Iron Man court filings – Confirms the lawsuit by Microsoft and Health-ISAC, the case number, the identities of the named defendants and the existence of the court-authorized temporary measure.
- Microsoft On the Issues – Describes the scope of the action, the seizure and redirection of domains, account deactivation, domain blocking and cooperation with partners.
- Microsoft Security Blog – Documents how YAM Store and the phishing kits operated, the attribution to Chinese-speaking actors and the reported malicious-message metrics.
- The Record – Independently corroborates the legal action, cooperation with Japanese police and the nature of the affected services.
Verified and updated: 10/15/2026 06:24
