Microsoft and Health-ISAC take down phishing kit marketplaces behind more than a billion malicious messages

Under an October 7 court order from the Southern District of Florida, Microsoft and Health-ISAC seized and redirected the domains of YAM Store, CoGUI and Iron Man, three Chinese-language cybercrime services selling fraudulent accounts, phishing kits and impersonation templates. Microsoft says the three enabled more than one billion malicious messages since January 2026, targeting over 75,000 organizations in more than 150 countries. Microsoft disabled over 20,000 YAM Store accounts and is blocking more than 100,000 impersonation domains.

Sources: SecurityWeek; BleepingComputer