Microsoft disrupts the supply chain behind mass phishing: YAM Store, CoGUI and Iron Man

A fake parcel notice, overdue charge or account warning may look like one isolated scam. Behind the message can sit an entire supply chain: a seller of illicit accounts, a ready-made phishing kit, delivery infrastructure and a customer who selects the brand and language to impersonate.

On 14 October, Microsoft and Health-ISAC announced action against three parts of such an ecosystem: YAM Store, CoGUI and Iron Man. Acting under a US court order, they seized and redirected domains supporting the operation. Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and continues to block more than 100,000 domains used for impersonation and fraud.

According to the Microsoft Digital Crimes Unit account, the services collectively enabled more than one billion malicious emails and text messages since January 2026, targeting over 75,000 organisations. More than 750 million messages were directed at Microsoft customers, and the activity reached more than 150 countries.

Breachroad’s conclusion: the operation makes one supplier network harder to use, but it does not eliminate the phishing-as-a-service business model. Organisations should not interpret the domain seizures as evidence that current campaigns have disappeared.

How the criminal service worked

YAM Store operated as a shop for scam infrastructure. Microsoft describes compromised or fraudulently obtained Microsoft and Google environments, accounts, licences and hosting capacity offered to criminal customers. In some cases, operators allegedly acquired expired domains once used by genuine organisations, rebuilt credible-looking websites and used those identities to establish cloud environments.

CoGUI, Haozi and Iron Man supplied ready-made phishing kits. A customer did not have to design a bank, parcel carrier or government form from scratch. They could buy a template, tailor the message and launch a campaign. Microsoft Threat Intelligence’s technical analysis says Iron Man alone contained more than 2,335 templates tailored to more than 139 countries.

The kits supported activities including:

• impersonating banks, government, healthcare, retailers and transport providers;
• collecting usernames, passwords, card details and verification codes;
• restricting access by country or IP address;
• using fake CAPTCHA gates to frustrate automated analysis;
• notifying an operator in real time as a target moved through the screens.

A company’s logo appearing in a kit does not show that the company itself was breached. Microsoft explicitly notes that the templates impersonated organisations; their presence is not evidence of compromise.

Why an infrastructure seizure does not end the risk

Legal and technical disruption matters because it removes access to some domains, accounts and services. Criminals can still register new domains, change provider or adopt another kit. Campaigns associated with the wider ecosystem did not necessarily depend on one identical server either.

For a recipient, the practical rule is simple: an old message does not become safe because some infrastructure has been seized. Do not reopen its link out of curiosity, and do not treat a dead landing page as proof that no data was exposed earlier.

For an organisation, the broader lesson is that mass phishing has become a product. Attackers with limited technical ability can purchase country-, industry- and brand-specific content. Defence therefore cannot rely only on blocking one domain after each campaign.

What a message recipient should do

When a message asks for payment, authentication or personal information:

1. do not use the link or phone number in the message;
2. open the official application or type the known service address yourself;
3. verify the request through a second channel;
4. report the message instead of circulating its live link;
5. if you submitted information, contact your bank or workplace support team immediately.

After a password is entered, changing it alone may not be enough. Active sessions should be revoked, MFA methods, mailbox rules, connected applications and recent sign-ins should be reviewed. If card information was submitted, contact the bank through an official channel and follow its response process.

A one-week plan for organisations

The first goal is to stop depending entirely on an employee spotting every lure. Training should help people recognise pressure and context changes, but technical controls still need to operate after a click.

Review whether:

• employees can report suspicious messages with one clear action;
• the response team can revoke sessions quickly rather than only reset passwords;
• privileged accounts use phishing-resistant MFA or passkeys;
• enrolling a new MFA method requires a trusted device or additional verification;
• mail filtering and link protection cover internally delivered messages too;
• identity alerts detect unusual sign-ins and privilege changes;
• finance, HR and customer-facing teams rehearse scenarios drawn from their real work.

Do not build employee guidance around the names YAM Store, CoGUI or Iron Man alone. Most recipients will never see those labels. Teach the observable behaviour instead: an urgent request, a sign-in reached from a message, an unexpected payment or a demand for a code.

Source facts and Breachroad recommendations

The message volumes, service descriptions, disabled-account count, blocked domains and court action come from Microsoft publications and the public case-document page. They are Microsoft findings and allegations arising from its investigation.

The assessment that organisations should treat phishing as a repeatable adversary business process, and the control plan above, are Breachroad recommendations. Our first-hour phishing response guide covers the next steps after details have been entered. Teams can practise recognition and safe escalation in our cybersecurity awareness and phishing training.