Microsoft's Digital Crimes Unit and Health-ISAC announced on October 14, 2026 that they have dismantled three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man.
The three services collectively enabled more than 1 billion malicious messages targeting over 75,000 organizations worldwide since January 2026, Microsoft reports. Over 750 million of those messages targeted Microsoft customers specifically. The campaigns reached consumers, healthcare organizations, financial institutions, and other businesses across more than 150 countries, generating tens of millions of dollars for the operators.
Three main findings
- Microsoft's Digital Crimes Unit and Health-ISAC have taken down YAM Store, CoGUI, and Iron Man, three services that provided criminals with fraudulent accounts, phishing sites, and impersonation templates
- The services enabled more than 1 billion malicious messages targeting over 75,000 organizations across more than 150 countries since January 2026, Microsoft states
- The action targets the suppliers of scam tools rather than only the scam messages themselves
Origins of the investigation
Japan's National Police Agency (NPA) alerted Microsoft to malicious messaging campaigns targeting people in Japan in late 2025, launching the investigation. Investigators initially expected to find individual campaigns. Tracing them back revealed instead a Chinese-language marketplace where criminals could purchase accounts, hosting services, and tools for building fake websites and online identities.
The Japan Cybercrime Control Center (JC3), drawing on intelligence from its more than 130 member organizations, helped confirm that what appeared to be separate incidents formed part of a broader pattern of scams targeting Japanese companies, financial institutions, and consumers.
Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs contributed intelligence and investigative support. Microsoft also worked with the US Secret Service and international law enforcement. The contributors connected accounts, websites, and infrastructure that initially appeared unrelated, exposing the broader marketplace behind them.
TRM's intelligence was key to locating and enabling the freeze of assets associated with the group.
The scam supply chain
The three services supplied different parts of the scam supply chain, reflecting a broader trend: modern fraud increasingly relies on businesses and services that make it easier for criminals to reach more victims. YAM Store sold accounts, while CoGUI and Iron Man supplied ready-made impersonation sites and templates.
YAM Store operations
YAM Store operated like an online shop. Customers could browse products, compare prices, and buy fraudulent Microsoft and Google accounts and other ready-made tools for scams, including credential theft. Controlled purchases by Microsoft confirmed how the store worked.
Operators bought internet domains that legitimate organizations had let expire, often those of nonprofits and educational institutions, in some cases. They rebuilt the websites to make the organizations look active, then used them to obtain Microsoft 365 accounts for sale.
CoGUI offerings
CoGUI supplied criminals with ready-made websites and messages impersonating companies, financial institutions, and government agencies. Criminals could deploy pages designed to steal passwords, payment information, and other personal data instead of building fraudulent sites themselves. CoGUI was one of the most widely used offerings in the ecosystem, particularly against victims in Japan and the United States. By mid-2026, a newer offering called Iron Man was increasingly replacing it.
Iron Man templates
Iron Man gave criminals access to thousands of ready-made templates impersonating trusted organizations. Through test purchases and work with Resecurity, investigators identified more than 2,300 templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments, and government agencies across more than 150 countries.
Some templates used the appearance of official authority to pressure victims into paying or disclosing sensitive information. The presence of an organization in these templates does not indicate that its systems were compromised.
Enforcement action
Microsoft and Health-ISAC seized and redirected domains that were part of the infrastructure powering YAM Store, CoGUI, and Iron Man with an order from the US District Court for the Southern District of Florida. As of October 14, 2026, Microsoft has disabled more than 20,000 accounts connected to YAM Store. It continues to dismantle the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.
YAM Store, CoGUI, and Iron Man are one part of a larger criminal network. Disrupting them makes it harder for criminals to obtain the accounts, tools, and infrastructure they rely on. TRM Labs contributed intelligence and investigative support to the takedown, with TRM's intelligence key to locating and enabling the freeze of assets associated with the group. Japan's NPA, JC3, Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs contributed intelligence and investigative support, and Microsoft also worked with the US Secret Service and international law enforcement.
Source: www.trmlabs.com